Access-point passphrase identification using key matching
A computer network device that performs key matching is described. While attempting to establish a secure connection with an electronic device, the computer network device may receive a connection-request message associated with the electronic device. In response, the computer network device may provide a context message addressed to a computer, where the context message requests stored passphrase information associated with the electronic device. Then, the computer network device may receive, associated with the computer, a context response. When the context response indicates that there is no stored passphrase information associated with the electronic device, the computer network device may perform the key matching to identify the passphrase associated with the electronic device. Next, the computer network device may provide, addressed to the computer, the identified passphrase associated with the electronic device or an encryption key corresponding to the identified passphrase for storage by the computer.
1 . A computer network device, comprising:
an interface circuit configured to communicate with an electronic device and a computer;
a processor coupled to the interface circuit; and
memory, coupled to the processor, configured to store program instructions, wherein, when executed by the processor, the program instructions cause the electronic device to perform operations comprising:
while attempting to establish a secure connection with the electronic device, receiving an authentication request associated with the electronic device;
providing a context message addressed to the computer based at least in part on the authentication request, wherein the context message requests stored passphrase information associated with the electronic device;
receiving, associated with the computer, a context response;
when the context response indicates that there is no stored passphrase information associated with the electronic device, the computer network device performs second operations comprising:
performing key matching to identify the passphrase associated with the electronic device; and
providing, addressed to the computer, the identified passphrase associated with the electronic device or an encryption key corresponding to the identified passphrase for storage by the computer; and
when the electronic device discontinues attempting to establish the secure connection while the computer network device is performing the key matching, the computer network device performs third operation comprising:
continuing to perform the key matching and, when the passphrase is identified, providing the identified passphrase or the encryption key addressed to the computer.
2 . The computer network device of claim 1 , wherein the computer network device comprises: an access point, a switch, or a router.
3 . The computer network device of claim 1 , wherein the passphrase comprises a dynamic pre-shared key (DPSK) or another type of digital certificate.
4 . The computer network device of claim 1 , wherein, after performing the key matching, the operations comprise establishing the secure connection with the electronic device based at least in part on the identified passphrase or the encryption key.
5 . The computer network device of claim 1 , wherein the operations comprise storing the passphrase or the encryption key in memory associated with the computer network device.
6 . The computer network device of claim 1 , wherein, after receiving the context response and before performing the key matching, the operations comprise providing a notification addressed to the computer that indicates that the computer network device is performing or will perform the key matching.
7 . The computer network device of claim 1 , wherein, after receiving the context response and before performing the key matching, the operations comprise exchanging authentication parameters with the electronic device; and
wherein the key matching is based at least in part on the authentication parameters.
8 . The computer network device of claim 7 , wherein exchanging the authentication parameters comprises:
providing, addressed to the electronic device, a first message in a four-way handshake with the electronic device, wherein the first messages comprise a random number associated with the computer network device; and
receiving, associated with the electronic device, a second message in the four-way handshake with the electronic device, wherein the second message comprises a second random number associated with the electronic device and a message integrity check (MIC).
9 . The computer network device of claim 8 , wherein the second message comprises inputs to a cryptographic calculation and an output of the cryptographic calculation.
10 . The computer network device of claim 1 , wherein, when the context response comprises the stored passphrase information, the operations comprise establishing the secure connection with the electronic device based at least in part on the stored passphrase information without performing the key matching.
11 . The computer network device of claim 1 , wherein the computer comprises a controller for the computer network device.
12 . The computer network device of claim 1 , wherein the computer comprises a remote authentication dial-in user service (RADIUS) server or an authentication, authorization, and accounting (AAA) server.
13 . The computer network device of claim 1 , wherein the computer network device comprises a second processor, and the key matching is performed by the second processor.
14 . A non-transitory computer-readable storage medium for use in conjunction with a computer network device, the computer-readable storage medium storing program instructions that, when executed by the computer network device, cause the computer network device to perform operations comprising:
while attempting to establish a secure connection with an electronic device, receiving an authentication request associated with the electronic device;
providing a context message addressed to a computer based at least in part on the authentication request, wherein the context message requests stored passphrase information associated with the electronic device;
receiving, associated with the computer, a context response;
when the context response indicates that there is no stored passphrase information associated with the electronic device, the computer network device performs second operations comprising:
performing key matching to identify the passphrase associated with the electronic device; and
providing, addressed to the computer, the identified passphrase associated with the electronic device or an encryption key corresponding to the identified passphrase for storage by the computer; and
when the electronic device discontinues attempting to establish the secure connection while the computer network device is performing the key matching, the computer network device performs third operation comprising:
continuing to perform the key matching and, when the passphrase is identified, providing the identified passphrase or the encryption key addressed to the computer.
15 . The non-transitory computer-readable storage medium of claim 14 , wherein, after receiving the context response and before performing the key matching, the operations comprise exchanging authentication parameters with the electronic device; and
wherein the key matching is based at least in part on the authentication parameters.
16 . The non-transitory computer-readable storage medium of claim 14 , wherein, when the context response comprises the stored passphrase information, the operations comprise establishing the secure connection with the electronic device based at least in part on the stored passphrase information without performing the key matching.
17 . A method for performing key matching, comprising:
by a computer network device:
while attempting to establish a secure connection with an electronic device, receiving an authentication request associated with the electronic device;
providing a context message addressed to a computer based at least in part on the authentication request, wherein the context message requests stored passphrase information associated with the electronic device;
receiving, associated with the computer, a context response;
when the context response indicates that there is no stored passphrase information associated with the electronic device, the computer network device performs operations comprising:
performing the key matching to identify the passphrase associated with the electronic device; and
providing, addressed to the computer, the identified passphrase associated with the electronic device or an encryption key corresponding to the identified passphrase for storage by the computer; and
when the electronic device discontinues attempting to establish the secure connection while the computer network device is performing the key matching, the computer network device performs second operation comprising:
continuing to perform the key matching and, when the passphrase is identified, providing the identified passphrase or the encryption key addressed to the computer.
18 . The method of claim 17 , wherein, after receiving the context response and before performing the key matching, the method comprises exchanging authentication parameters with the electronic device; and
wherein the key matching is based at least in part on the authentication parameters.
19 . The method of claim 17 , wherein, when the context response comprises the stored passphrase information, the method comprises establishing the secure connection with the electronic device based at least in part on the stored passphrase information without performing the key matching.
20 . The method of claim 17 , wherein, after receiving the context response and before performing the key matching, the method comprises providing a notification addressed to the computer that indicates that the computer network device is performing or will perform the key matching.