System and method for pre-shared key (PSK) based wireless access point authentication
The method provides an automated and scalable system for the generation, distribution, management of symmetric pre-shared keys (PSKs) to applications executing on headless and mobile devices. It helps achieve device protection, application security, and data protection with data authenticity and confidentiality in intra-device, inter-device, device-to-edge, and device-to-cloud communications. It helps Transport Layer Security (TLS) enabled applications dynamically acquire and renew PSKs and use identity hints for PSK based authentication ceremony during a TLS handshake. It helps manage and distribute API shared secrets and API access tokens required for authenticated API requests and API security. It helps applications (producers, brokers, and consumers of content) with PSKs for supply chain tamper resistance. It helps real-time low-latency applications with selective encryption of partial messages.
1. A method of distributing a symmetric internal wireless access point (WAP) pre-shared key (IWAP-PSK) for secure wireless authentication by a device with a WAP in a production network including a supplicant program executing on the device, the WAP configured for multi-SSID (service set identifier) mode of operation, a key distribution service (KDS), a KDS proxy, a KDS interface, a symmetric KDS member PSK (M-PSK), a M-PSK identity hint, a tenant identifier, a device group identifier associated with the tenant identifier, a member domain associated with the device group identifier, an application identifier associated with the device group identifier, the IWAP-PSK identity hint, an internal WAP SSID (IWAP-SSID), a guest WAP pre-shared key (GWAP-PSK), a guest WAP SSID (GWAP-SSID), a key record, a dynamic host configuration protocol (DHCP) server, and a domain name system (DNS) server, the method comprising:
authenticating, by the supplicant program with the WAP, using the GWAP-SSID and GWAP-PSK, to establish initial wireless access for the device over the production network;
authenticating, with the KDS, by the supplicant program executing on the device, using the tenant identifier, the symmetric KDS member PSK (M-PSK) and the M-PSK identity hint, wherein the device is registered by a DNS hostname on the DNS server configured with the KDS or KDS proxy, and configured as a first member a device group on the KDS;
retrieving, by the supplicant program, the IWAP-PSK from the KDS, using at least the device group identifier and the IWAP-PSK identity hint, for use as a shared symmetric key for authentication with the wireless access point; and
authenticating, by the supplicant program with the WAP, using the IWAP-SSID and the retrieved IWAP-PSK to establish secure wireless access for the device over the production network to perform a switch-over from a guest SSID to an internal SSID wireless network.
2. The method of claim 1 , wherein the device member authentication handshake is performed by the KDS interface on the device using the tenant identifier, the device member PSK (M-PSK) and the M-PSK identity hint as a first factor of device authentication, and further wherein the session key is generated using a key exchange handshake between the KDS interface and the KDS or the KDS proxy, and further wherein a device member validation is performed as a second factor of device authentication:
performing, by the KDS or the KDS proxy, a DNS reverse lookup of a device member IP address to query for the DNS hostname;
retrieving, by the KDS or the KDS proxy, the DNS hostname from a resource record in a DNS response; and
comparing and matching, by the KDS or the KDS proxy, the retrieved DNS hostname with the device member identifier in the KDS requests.
3. The method of claim 2 , wherein a device authentication and a plurality of key exchange handshakes are performed over a connection-less User Datagram Protocol (UDP) or connection-oriented Transmission Control Protocol (TCP) transport protocol, without requiring a security transport protocol.
4. The method of claim 1 , wherein the KDS interface provides a plurality of application programming interfaces (APIs), wherein applications send a plurality of requests for key operations directly to the KDS and receive a plurality of responses for key operations directly from the KDS, or wherein the applications send a plurality of requests for key operations indirectly through the KDS proxy and receive a plurality of responses for key operations indirectly through the KDS proxy.
5. The method of claim 1 , wherein the device registered by a unique DNS hostname in the domain on a local DNS server with an IP address (A) record and a Pointer Record (PTR) record used in a DNS hostname reverse lookup.
6. The method of claim 1 , wherein on the KDS, the device is configured as a member of a tenancy associated with the tenant identifier and the device group associated with the tenant identifier, and further wherein the device group is configured with a key record that includes a key instance (IWAP-PSK) for secure wireless authentication.
7. The method of claim 1 , wherein a key record configured for the device group on the KDS includes a key expiration timestamp and a key status to manage automatic key renewal, key rotation, and key revocation operations on the KDS.
8. The method of claim 1 , wherein an authenticated member device's request for a key operation, based on the device group identifier and the IWAP-PSK identity hint, is processed by the KDS and permitted based on a match of a member domain with a domain derived from a plurality of resource records retrieved by a DNS reverse lookup for a member device DNS hostname.
9. The method of claim 1 , wherein the GWAP-SSID, the GWAP-PSK, the IWAP-SSID, the M-PSK, and the M-PSK identity hint are factory configured attributes on an executable application image or a system firmware on a real time operating system (RTOS) platform or specified through a configuration file on a general purpose operating system (GPOS) platform.
10. The method of claim 1 , wherein the primary and secondary KDS/KDS proxy URLs, the tenant identifier, and the device group identifier and identity hints associated with the production WAP for secure access are discovered using network characteristics based on custom attributes configured on a DHCP server, or a DNS server, associated with the member device LAN.
11. The method of claim 1 , wherein an authenticated member device's request for a key operation, based on the device group identifier, the IWAP-PSK identity hint, and the application identifier, is processed by the KDS and permitted based on a match with an application identifier associated with the device group identifier to allow or deny the key operation.
12. The method of claim 1 , wherein device specific information configured as extended custom attributes for a member device is retrieved from the DHCP server using a plurality of extended KDS interfaces to automate local device configuration and export vendor specific member device information to the KDS.
13. The method of claim 1 , wherein an authenticated member device's request for a key operation, based on the device group identifier and the IWAP-PSK identity hint, is processed by the KDS and permitted based on a match of the member device tenant identifier with an associated license owner identifier retrieved from the DHCP server as a vendor specific member device information.
14. The method of claim 1 , wherein the supplicant program detects a change in the IWAP-PSK based on failure to authenticate with the WAP using the IWAP-SSID and last retrieved and stored IWAP-PSK, and automatically switch-over to a guest wireless network using the GWAP-SSID and the GWAP-PSK, authenticate with the KDS, retrieve a IWAP-PSK from the KDS, and authenticate with the WAP using the IWAP-SSID and retrieved IWAP-PSK to switch-over to a secure wireless network.
15. The method of claim 1 , wherein the supplicant program, for security reasons, does not store a last retrieved IWAP-PSK locally on the device, and dynamically at power cycle or application restart, authenticate with a guest wireless network using the GWAP-SSID and the GWAP-PSK, authenticate with the KDS, retrieve an IWAP-PSK from the KDS, and authenticate with the WAP using the IWAP-SSID and retrieved IWAP-PSK to switch-over to a secure wireless network.
16. The method of claim 1 , wherein the supplicant program is a Wi-Fi supplicant, or a Wi-Fi supplicant function implemented within a production application or system firmware.