Exclusive preshared key authentication
Preshared keys are assigned to client devices, users, or user groups. The set of valid preshared keys or keys derived therefrom is distributed to network devices such as wireless access points. A client device attempts to establish a secure network connection with a network device using its assigned preshared key. A network device identifies the client device's preshared key by selecting a candidate key from its set of valid preshared keys. The network device determines a validation cryptographic checksum based on the selected candidate key. If the validation cryptographic checksum matches the client's cryptographic checksum, the network device establishes a secure network connection with the client device using this candidate key. If the validation cryptographic checksum does not match the cryptographic checksum provided by the client device, the network device repeats this comparison using different candidate keys selected from its set of valid preshared keys until a match is found.
1. A method comprising:
receiving an exclusive preshared key assigned to a user group, each user of the user group being different from a device, wherein the exclusive preshared key is uniquely associated with the user group to prevent the exclusive preshared key from being used by other user groups and wherein each user of the user group is enabled to simultaneously use the exclusive preshared key on a plurality of devices on respective network connections;
distributing, by a network device management application, the exclusive preshared key and a user credential of a user in the user group to a network device configured to provide wireless access to network services of a network;
wirelessly connecting a client device to the network device for purposes of the client device attempting to authenticate for accessing the network services;
determining, at the network device, whether a preshared key used by the client device to access the network services matches the exclusive preshared key;
in response to determining the preshared key used by the client device matches the exclusive preshared key, sending, from the network device to an authentication server, the user credential for authentication of the client device;
sending, by the network device, a message to an accounting server, the message instructing the accounting server to begin tracking an amount of time the client device has accessed the network services or an amount of bandwidth used by the client device in accessing the network services; and
after the client device has accessed the network services for a predetermined period of time or has used a predetermined amount of bandwidth, terminating, by the network device, access to the network services.
2. The method of claim 1 , further comprising identifying whether the preshared key used by the client device matches the exclusive preshared key using a 4-way handshake authentication technique.
3. The method of claim 1 , further comprising:
deriving, at the network device, a first pairwise master key from at least one exclusive preshared key distributed to the network device;
receiving, from the client device, a second pairwise master key from the preshared key used by the client device, the second pairwise master key being derived by the client device; and
determining, at the network device and based on the first pairwise master key and the second pairwise master key, whether the preshared key used by the client device matches the exclusive preshared key.
4. The method of claim 1 , further comprising:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device;
receiving, from the client device at the network device, a second message generated in response to the client device receiving the first message from the network device using the preshared key used by the client device; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key assigned to the user group to identify whether the preshared key used by the client device to matches the exclusive preshared key.
5. The method of claim 1 , further comprising:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device;
receiving, from the client device at the network device, a second message including a client generated message integrity code generated in response to the client device receiving the first message from the network device using the preshared key used by the client device;
generating, at the network device, a verification message integrity code using the exclusive preshared key distributed to the network device; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key based on whether the client generated message integrity code matches the verification message integrity code generated at the network device to identify whether the preshared key used by the client device matches the exclusive preshared key.
6. The method of claim 1 , further comprising:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device;
receiving, from the client device at the network device, a second message including a client generated message integrity code generated in response to the client device receiving the first message from the network device using the preshared key used by the client device to authenticate for accessing the network services;
generating, at the network device, a plurality of verification message integrity codes using a locally stored plurality of exclusive preshared keys including the exclusive preshared key distributed to the network device; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key based on whether the client generated message integrity code matches at least one verification message integrity code of the plurality of verification message integrity codes generated at the network device to identify whether the preshared key used by the client device matches the exclusive preshared key.
7. The method of claim 1 , further comprising:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device;
receiving, from the client device at the network device, a second message including a client generated message integrity code generated in response to the client device receiving the first message from the network device using the preshared key and encrypted using a pairwise transient key generated from an A-nonce included in the first message and the preshared key;
generating, at the network device, a verification message integrity code using the exclusive preshared key distributed to the network device and an S-nonce included in the second message and determined at the network device from a separately calculated pairwise transient key determined at the network device using the exclusive preshared key; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key assigned to the user group based on whether the client generated message integrity code matches the verification message integrity code generated at the network device to identify whether the preshared key used by the client device matches the exclusive preshared key.
8. The method of claim 1 , further comprising:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device for purposes of the client device attempting to authenticate for accessing the network services;
receiving, from the client device at the network device, a second message including a client generated message integrity code generated in response to the client device receiving the first message from the network device using the preshared key and encrypted using a pairwise transient key generated from an A-nonce included in the first message and the preshared key;
generating, at the network device, a plurality of verification message integrity codes using a locally stored plurality of exclusive preshared keys included in the exclusive preshared key distributed to the network device and an S-nonce included in the second message and determined at the network device from a separately calculated pairwise transient key determined at the network device using at least one of the locally stored plurality of exclusive preshared keys; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key assigned to the specific group of users based on whether the client generated message integrity code matches at least one verification message code of the plurality of verification message integrity codes generated at the network device to identify whether the preshared key used by the client device matches the exclusive preshared key.
9. The method of claim 1 , further comprising:
receiving a username; and
determining the exclusive preshared key to be assigned to the user group using the username as part of the exclusive preshared key.
10. The method of claim 1 , further comprising:
distributing, by the network device management application, the exclusive preshared key to a second client device associated with the user in the user group;
distributing, by the network device management application, the exclusive preshared key and the user credential of the user in the user group to a second network device configured to provide wireless access to the network services of the network, wherein the network device is a first network device;
wirelessly connecting the second client device to the second network device;
determining, at the second network device, whether a preshared key used by the second client device to authenticate for accessing the network services of the network through the second network device matches the exclusive preshared key assigned to the user group;
in response to determining the preshared key used by the second client device matches the exclusive preshared key assigned to the user group, sending the user credential from the second network device to the authentication server;
sending, by the second network device, a message to the accounting server, the message instructing the accounting server to begin tracking an amount of time the second client device has accessed the network services of the network or an amount of bandwidth used by the second client device in accessing the network services of the network; and
after the second client device has accessed the network services for a predetermined period of time or has used a predetermined amount of bandwidth, terminating, by the second network device, access to the network services.
11. A non-transitory computer-readable medium including instructions adapted to direct a computer to perform operations, the operations comprising:
receiving an exclusive preshared key assigned to a user group, each user of the user group being different from a device, wherein the exclusive preshared key is uniquely associated with the user group to prevent the exclusive preshared key from being used by other user groups and wherein each user of the user group is enabled to simultaneously use the exclusive preshared key on a plurality of devices on respective network connections;
distributing, by a network device management application, the exclusive preshared key and user credential of a user in the user group to a network device configured to provide wireless access to network services of a network;
wirelessly connecting a client device to the network device for purposes of the client device attempting to authenticate for accessing the network services;
determining, at the network device, whether a preshared key used by the client device to access the network services matches the exclusive preshared key;
in response to determining the preshared key used by the client device matches the exclusive preshared key, sending, from the network device to an authentication server, the user credential for authentication of the client device;
sending, by the network device, a message to an accounting server, the message instructing the accounting server to begin tracking an amount of time the client device has accessed the network services or an amount of bandwidth used by the client device in accessing the network services; and
after the client device has accessed the network services for a predetermined period of time or has used a predetermined amount of bandwidth in accessing the network services, terminating, by the network device, access to the network services.
12. The non-transitory computer-readable medium of claim 11 , the operations further including identifying whether the preshared key used by the client device matches the exclusive preshared key using a 4-way handshake authentication technique.
13. The non-transitory computer-readable medium of claim 11 , the operations further including:
deriving, at the network device, a first pairwise master key from at least one exclusive preshared key distributed to the network device;
receiving, from the client device, a second pairwise master key from the preshared key used by the client device, the second pairwise master key being derived by the client device; and
determining, at the network device and based on the first pairwise master key and the second pairwise master key, whether the preshared key used by the client device matches the exclusive preshared key.
14. The non-transitory computer-readable medium of claim 11 , the operations further including:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device;
receiving, from the client device at the network device, a second message generated in response to the client device receiving the first message from the network device using the preshared key used by the client device; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key assigned to the user group to identify whether the preshared key used by the client device matches the exclusive preshared key.
15. The non-transitory computer-readable medium of claim 11 , the operations further including:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device;
receiving, from the client device at the network device, a second message including a client generated message integrity code generated in response to the client device receiving the first message from the network device using the preshared key used by the client device;
generating, at the network device, a verification message integrity code using the exclusive preshared key distributed to the network device; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key based on whether the client generated message integrity code matches the verification message integrity code generated at the network device to identify whether the preshared key used by the client device matches the exclusive preshared key.
16. The non-transitory computer-readable medium of claim 11 , the operations further including:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device;
receiving, from the client device at the network device, a second message including a client generated message integrity code generated in response to the client device receiving the first message from the network device using the preshared key used by the client device to authenticate for accessing the network services of the network;
generating, at the network device, a plurality of verification message integrity codes using a locally stored plurality of exclusive preshared keys including the exclusive preshared key distributed to the network device; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key based on whether the client generated message integrity code matches at least one verification message integrity code of the plurality of verification message integrity codes generated at the network device to identify whether the preshared key used by the client device matches the exclusive preshared key.
17. The non-transitory computer-readable medium of claim 11 , the operations further including:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device;
receiving, from the client device at the network device, a second message including a client generated message integrity code generated in response to the client device receiving the first message from the network device using the preshared key and encrypted using a pairwise transient key generated from an A-nonce included in the first message and the preshared key;
generating, at the network device, a verification message integrity code using the exclusive preshared key distributed to the network device and an S-nonce included in the second message and determined at the network device from a separately calculated pairwise transient key determined at the network device using the exclusive preshared key; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key assigned to the user group based on whether the client generated message integrity code matches the verification message integrity code generated at the network device to identify whether the preshared key used by the client device matches the exclusive preshared key.
18. The non-transitory computer-readable medium of claim 11 , the operations further including:
sending, from the network device to the client device, a first message in response to the client device being wirelessly connected to the network device for purposes of the client device attempting to authenticate for accessing the network services of the network through the network device;
receiving, from the client device at the network device a second message, including a client generated message integrity code generated in response to the client device receiving the first message from the network device using the preshared key and encrypted using a pairwise transient key generated from an A-nonce included in the first message and the preshared key;
generating, at the network device, a plurality of verification message integrity codes using a locally stored plurality of exclusive preshared keys included in the exclusive preshared key distributed to the network device and an S-nonce included in the second message and determined at the network device from a separately calculated pairwise transient key determined at the network device using at least one of the locally stored plurality of exclusive preshared keys; and
determining, at the network device and based on the second message, whether the second message was generated by the client device using the exclusive preshared key assigned to the specific group of users based on whether the client generated message integrity code matches at least one verification message code of the plurality of verification message integrity codes generated at the network device to identify whether the preshared key used by the client device matches the exclusive preshared key.
19. The non-transitory computer-readable medium of claim 11 , the operations:
distributing, by the network device management application, the exclusive preshared key to a second client device associated with the user in the user group;
distributing, by the network device management application the exclusive preshared key and the user credential of the user in the user group to a second network device configured to provide wireless access to the network services of the network, wherein the network device is a first network device;
wirelessly connecting the second client device to the second network device;
determining at the second network device whether a preshared key used by the second client device to authenticate for accessing the network services of the network through the second network device matches the exclusive preshared key assigned to the user group;
in response to determining the preshared key used by the second client device matches the exclusive preshared key assigned to the user group, sending the user credential from the second network device to the authentication server;
sending, by the second network device, a message to the accounting server, the message instructing the accounting server to begin tracking an amount of time the second client device has accessed the network services of the network or an amount of bandwidth used by the second client device in accessing the network services; and
after the second client device has accessed the network services for a predetermined period of time or has used a predetermined amount of bandwidth, terminating, by the second network device, access to the network services.