Private simultaneous authentication of equals

1. A method comprising:

receiving, at a user side, first commitment data, from a network device for authentication of an end user device based on a private simultaneous authentication of equals (SAE) scheme;

generating, at the user side, second commitment data based on a passphrase assigned to the end user device;

sending the generated second commitment data from the end user device to the network device;

generating, at the user side, a shared secret based on the passphrase and the first commitment data;

creating, at the user side, a second confirmation value based on the shared secret; sending the second confirmation value from the end user device to the network device,

such that the network device determines whether the end user device has the same shared secret based on comparison of a first confirmation value generated at a network side based on the second commitment data and the passphrase with the second confirmation value;

if it is determined that the end user device has the same shared secret, accessing network services of the network using a master key generated based on the shared secret, the master key being used to exchange data between the end user device and the network device for the network services, wherein the first commitment data includes a second scalar and a second element, and the shared secret is generated based on the second scalar and the second element of the first commitment data.

2. The method of claim 1 , wherein the generating, at the user side, the second commitment data comprises:

generating, at the user side, a first random value and a first mask value;

generating, at the user side, a first scalar and a first element based on the first random value, the first mask value, and the passphrase, the second commitment data including the first scalar and the first element.

3. The method of claim 1 , wherein the generating, at the user side, the second commitment data comprises:

generating, at the user side, a first random value and a first mask value;

generating, at the user side, a passphrase equivalent from the passphrase;

generating, at the user side, a first scalar and a first element based on the first random value, the first mask value, and the passphrase equivalent, the second commitment data including the first scalar and the first element.

4. The method of claim 1 , wherein the creating, at the user side, the second confirmation value comprises:

generating, at the user side, a confirmation key based on the shared secret and at least a portion of the first commitment data or the second commitment data;

generating, at the user side, the second confirmation value, based on the generated confirmation key.

5. The method of claim 1 , wherein the passphrase assigned to the end user device is uniquely associated with the end user device for use in authenticating the end user device to access the network services of the network through the private SAE scheme or uniquely associated with a subset of end user devices including the end user device for use in authenticating the end user devices to access the network services of the network through the private SAE scheme.

6. The method of claim 1 , further comprising locally installing, at the end user device, the passphrase for use in automatically authenticating the end user device to access the network services of the network absent input from a user of the end user device.

7. The method of claim 1 , wherein the passphrase assigned to the end user device is obtained based on input from a user of the end user device.

8. The method of claim 1 , wherein the second commitment data generated in a first instance is different from the second commitment data generated in a second instance.

9. A system comprising:

a device side private simultaneous authentication of equals (SAE) commit engine configured to:

generate second commitment data based on a passphrase assigned to an end user device;

send the generated second commitment data to a network device;

generate a shared secret based on the passphrase and first commitment data that is received from the network device for authentication of the end user device based on a private simultaneous authentication of equals (SAE) scheme;

a device side private SAE confirm engine configured to:

create a second confirmation value based on the shared secret;

send the second confirmation value to the network device, such that the network device determines whether the end user device has the same shared secret, based on comparison of a first confirmation value generated at a network side based on the second commitment data and the passphrase with the second confirmation value, wherein if it is determined that the end user device has the same shared secret, access to network services of the network using a master key generated based on the shared secret is enabled, the master key being used to exchange data between the end user device and the network device for the network services, wherein the first commitment data includes a second scalar and a second element, and the device side private SAE commit engine generates the shared secret based on the second scalar and the second element of the first commitment data.

10. The system of claim 9 , wherein the device side private SAE commit engine is further configured to:

generate a first random value and a first mask value;

generate a first scalar and a first element based on the first random value, the first mask value, and the passphrase, the second commitment data including the first scalar and the first element.

11. The system of claim 9 , wherein the device side private SAE commit engine is further configured to:

generate a first random value and a first mask value;

generate a passphrase equivalent from the passphrase;

generate a first scalar and a first element based on the first random value, the first mask value, and the passphrase equivalent, the second commitment data including the first scalar and the first element.

12. The system of claim 9 , wherein the device side private SAE confirm engine is further configured to:

generate a confirmation key based on the shared secret and at least a portion of the first commitment data or the second commitment data;

generate the second confirmation value, based on the generated confirmation key.

13. The system of claim 9 , wherein the passphrase assigned to the end user device is uniquely associated with the end user device for use in authenticating the end user device to access the network services of the network through the private SAE scheme or uniquely associated with a subset of end user devices including the end user device for use in authenticating the end user devices to access the network services of the network through the private SAE scheme.

14. The system of claim 9 , further comprising a device side passphrase identification engine configured to locally install the passphrase for use in automatically authenticating the end user device to access the network services of the network absent input from a user of the end user device.

15. The system of claim 9 , further comprising a device side passphrase identification engine configured to receive input corresponding to the passphrase from a user of the end user device.

16. The system of claim 9 , wherein the second commitment data generated in a first instance is different from the second commitment data generated in a second instance.

17. A computer program product comprising instructions which, when the program is executed by a computer, cause the computer to carry out:

receiving, at a user side, first commitment data, from a network device for authentication of an end user device based on a private simultaneous authentication of equals (SAE) scheme;

generating, at the user side, second commitment data based on a passphrase assigned to the end user device;

sending the generated second commitment data from the end user device to the network device;

generating, at the user side, a shared secret based on the passphrase and the first commitment data;

creating, at the user side, a second confirmation value based on the shared secret;

sending the second confirmation value from the end user device to the network device, such that the network device determines whether the end user device has the same shared secret based on comparison of a first confirmation value generated at a network side based on the second commitment data and the passphrase with the second confirmation value;

if it is determined that the end user device has the same shared secret, accessing network services of the network using a master key generated based on the shared secret, the master key being used to exchange data between the end user device and the network device for the network services, wherein the first commitment data includes a second scalar and a second element, and the shared secret is generated based on the second scalar and the second element of the first commitment data.

18. The computer program product of claim 17 , wherein the passphrase assigned to the end user device is uniquely associated with the end user device for use in authenticating the end user device to access the network services of the network through the private SAE scheme or uniquely associated with a subset of end user devices including the end user device for use in authenticating the end user devices to access the network services of the network through the private SAE scheme.

19. The computer program product of claim 17 , wherein the instructions further cause the computer to carry out locally installing, at the end user device, the passphrase for use in automatically authenticating the end user device to access network services of the network absent input from a user of the end user device.

20. The computer program product of claim 17 , wherein the passphrase assigned to the end user device is obtained based on input from a user of the end user device.