Key management for fast transitions
When an access point associates with an electronic device, the access point may establish secure communication with the electronic device using a four-way handshake with the electronic device. Next, the access point may distribute secondary pairwise master keys (PMKs) to radio-frequency (RF)-neighbor access points of the access point in a wireless local area network, where the secondary PMKs facilitate fast basic service set (BSS) transitions with the electronic device when a handover occurs without using the four-way handshake to establish secure communication with the electronic device. Furthermore, when the access point receives information that indicates that the electronic device has associated with a second access point in the RF-neighbor access points of the access point, the access point provides instructions to delete the secondary PMKs at the RF-neighbor access points of the access point, and provides additional secondary PMKs to RF-neighbor access points of the second access point.
1. An access point, comprising:
an interface circuit that is configured to communicate with an electronic device and with other access points in a wireless local area network (WLAN), wherein the access point is configured to:
determine and store topography information specifying radio-frequency (RF)-neighbor access points for the access point and the other access points based on the communication between the access point and the other access points;
when the access point associates with the electronic device, designate the access point as a master access point in the WLAN for the electronic device;
generate, based on a pre-shared key (PSK), a pairwise master key (PMK) associated with the access point and the electronic device;
using a four-way handshake with the electronic device, calculate a pairwise transient key (PTK) to enable secure communication with the electronic device;
generate and distribute secondary PMKs to RF-neighbor access points of the access point based on the topography information, wherein each of the secondary PMKs are unique, and wherein the secondary PMKs facilitate fast basic service set (BSS) transitions with the electronic device when a handover occurs without using the four-way handshake to establish secure communication with the electronic device;
receive association information from a second access point in the RE-neighbor access points of the access point that indicates that the electronic device has associated with the second access point; and
in response to the association information:
provide instructions to delete the secondary PMKs at the RF-neighbor access points of the access point; and
provide additional secondary PMKs to RE-neighbor access points of the second access point.
2. The access point of claim 1 , wherein the communication between the access point and the other access points comprise wired communication, wireless communication or both.
3. The access point of claim 1 , wherein the PSK comprises Extensible Authentication Protocol (EAP) parameters; and
wherein the access point obtains the EAP parameters from a server when authenticating the electronic device in the WLAN.
4. The access point of claim 1 , wherein the PMK is generated using a secure hashing function based on the PSK.
5. The access point of claim 1 , wherein the four-way handshake is compatible with an IEEE 802.11i standard and the fast basic service set (BSS) transitions is compatible with an IEEE 802.11r standard.
6. The access point of claim 1 , wherein the RF-neighbor access points of a given access point, which is one of the other access points and the access point, are nearest RF neighbors of the given access point.
7. The access point of claim 1 , wherein, when distributing the secondary PMKs, the access point includes information that indicates the access point is the master access point in the WLAN for the electronic device.
8. The access point of claim 1 , wherein, when a number of electronic devices associated with the access point exceeds a threshold value and a number of electronic devices associated with the second access point is less than the threshold value, the access point is configured to designate, after receiving the association information, the second access point as the master access point in the WLAN for the electronic device.
9. The access point of claim 1 , wherein, when the access point receives one of a disassociate message from the electronic device or a time-out message from the controller, the access point is configured to delete the PMK and is configured to provide instructions to delete the secondary PMKs at the RF-neighbor access points of the access point.
10. The access point of claim 1 , wherein the access point further comprises:
a processor, coupled to the interface circuit and memory, configured to execute program instructions; and
the memory, coupled to the processor, configured to store the program instructions, wherein the program instructions comprise instructions for at least some of the operations performed by the access point.
11. A method for facilitating fast handoffs in a wireless local area network (WLAN) that comprises an access point and other access points, wherein the method comprises:
determining and storing topography information specifying radio-frequency (RF)-neighbor access points for the access point and the other access points based on the communication between the access point and the other access points;
when the access point associates with an electronic device, designating the access point as a master access point in the WLAN for the electronic device;
generating, based on a pre-shared key (PSK), a pairwise master key (PMK) associated with the access point and the electronic device;
using a four-way handshake with the electronic device, calculating a pairwise transient key (PTK) to enable secure communication with the electronic device;
generating and distributing secondary PMKs to RE-neighbor access points of the access point based on the topography information, wherein each of the secondary PMKs are unique, and wherein the secondary PMKs facilitate fast basic service set (BSS) transitions with the electronic device when a handover occurs without using the four-way handshake to establish secure communication with the electronic device;
receiving association information from a second access point in the RE-neighbor access points of the access point that indicates that the electronic device has associated with the second access point; and
in response to the association information:
providing instructions to delete the secondary PMKs at the RE-neighbor access points of the access point; and
providing additional secondary PMKs to RF-neighbor access points of the second access point.
12. The method of claim 11 , wherein the communication between the access point and the other access points comprise wired communication, wireless communication or both.
13. The method of claim 11 , wherein the PSK includes Extensible Authentication Protocol (EAP) parameters; and
wherein the method further comprises obtaining the EAP parameters from a server when authenticating the electronic device in the WLAN.
14. The method of claim 11 , wherein the PMK is generated using a secure hashing function based on the PSK.
15. The method of claim 11 , wherein the four-way handshake is compatible with an IEEE 802.11i standard and the fast basic service set (BSS) transitions is compatible with an IEEE 802.11r standard.
16. The method of claim 11 , wherein the RF-neighbor access points of a given access point, which is one of the other access points and the access point, are nearest RF neighbors of the given access point.
17. The method of claim 11 , wherein, when distributing the secondary PMKs, the access point includes information that indicates the access point is the master access point in the WLAN for the electronic device.
18. The method of claim 11 , wherein, when a number of electronic devices associated with the access point exceeds a threshold value and a number of electronic devices associated with the second access point is less than the threshold value, the method further comprises designating, after receiving the association information, the second access point as the master access point in the WLAN for the electronic device.
19. The method of claim 11 , wherein, when the access point receives one of a disassociate message from the electronic device and a time-out message from the controller, the method further comprises deleting the PMK and providing instructions to delete the secondary PMKs at the RE-neighbor access points of the access point.
20. A non-transitory computer-readable storage medium for use in conjunction with an access point, the computer-readable storage medium storing program instructions, wherein, when executed by the access point, the program instructions cause the access point to perform operations that facilitate fast handoffs in a wireless local area network (WLAN) that comprises an access point and other access points, the operations comprising:
determining and storing topography information specifying radio-frequency (RF)-neighbor access points for the access point and the other access points based on the communication between the access point and the other access points;
designating, when the access point associates with an electronic device, the access point as a master access point in the WLAN for the electronic device;
generating, based on a pre-shared key (PSK), a pairwise master key (PMK) associated with the access point and the electronic device;
calculating, using a four-way handshake with the electronic device, a pairwise transient key (PTK) to enable secure communication with the electronic device;
generating and distributing secondary PMKs to RF-neighbor access points of the access point based on the topography information, wherein each of the secondary PMKs are unique, and wherein the secondary PMKs facilitate fast basic service set (BSS) transitions with the electronic device when a handover occurs without using the four-way handshake to establish secure communication with the electronic device;
receiving association information from a second access point in the RF-neighbor access points of the access point that indicates that the electronic device has associated with the second access point; and
in response to the association information:
providing instructions to delete the secondary PMKs at the RF-neighbor access points of the access point; and
providing additional secondary PMKs to RE-neighbor access points of the second access point.