WI-FI PROTECTED ACCESS 3-COMPATIBLE AUTHENTICATION USING AN ESTABLISHED BINDING
During operation, an access point may provide a first WLAN and a second WLAN, where the first WLAN uses a WPA2-compatible authentication protocol and the second WLAN uses a WPA3-compatible authentication protocol. In response to an association request or a probe request associated with (or from) an electronic device, the access point may establish a connection with the electronic device using the first WLAN. Then, when a binding between a passphrase associated with the electronic device and the second WLAN does not exist, the access point may establish the binding in the computer system. Next, the access point may perform a BSS transition of the electronic device from the first WLAN to the second WLAN. Moreover, the access point may authenticate the electronic device without a time constraint.
1 . A computer network device, comprising:
an interface circuit configured to communicates with an electronic device and a computer system;
a processor; and
a memory that stores program instructions, wherein, when executed by the processor, the program instructions cause the computer to perform operations, comprising:
providing a first wireless local area network (WLAN) and a second WLAN, wherein the first WLAN uses a Wi-Fi Protected Access 2 (WPA2)-compatible authentication protocol and the second WLAN uses a Wi-Fi Protected Access 3 (WPA3)-compatible authentication protocol;
receiving, associated with the electronic device, an association request or a probe request;
establishing a connection with the electronic device using the first WLAN;
when a binding between a passphrase associated with the electronic device and the second WLAN does not exist, establishing the binding in the computer system;
performing a basic service set (BSS) transition of the electronic device from the first WLAN to the second WLAN; and
authenticating the electronic device without a time constraint.
2 . The computer network device of claim 1 , wherein, when a connection to the second WLAN is lost, re-establishing a second connection with the electronic device using the first WLAN or the second WLAN without the time constraint.
3 . The computer network device of claim 1 , wherein the authentication is performed with an authentication, authorization, and accounting (AAA) server.
4 . The computer network device of claim 1 , wherein the operations comprise updating a state entry associated with the electronic device in a state table when the binding is established.
5 . The computer network device of claim 1 , wherein the connection with the electronic device is established using the first WLAN when the connection comprises a first instance of the connection.
6 . The computer network device of claim 5 , wherein the operations comprise confirming that an association with the electronic device is the first instance of the connection based at least in part on the state entry in the state table.
7 . The computer network device of claim 6 , wherein, when a request to establish a subsequent instance of a connection with the electronic device occurs, the operations comprise establishing the subsequent instance of the connection with the electronic device using the second WLAN based at least in part on the state entry in the state table.
8 . The computer network device of claim 1 , wherein the second WLAN uses WPA3-simultaneous authentication of equals (SAE).
9 . The computer network device of claim 1 , wherein the first WLAN and the second WLAN have the same service set identifier (SSID) and different basic service set identifiers (BSSIDs).
10 . The computer network device of claim 1 , wherein the BSS transition is based at least in part on the association of the electronic device and the computer network device using the first WLAN.
11 . The computer network device of claim 1 , wherein the passphrase comprises a dynamic pre-shared key (DPSK) of the electronic device.
12 . The computer network device of claim 1 , wherein the computer network device comprises an access point.
13 . The computer network device of claim 1 , wherein the authentication occurs without the computer system performing a cryptographic calculation or using a single cryptographic calculation.
14 . A non-transitory computer-readable storage medium for use in conjunction with a computer network device, the computer-readable storage medium storing program instructions that, when executed by the computer network device, cause the computer network device to perform operations comprising:
providing a first wireless local area network (WLAN) and a second WLAN, wherein the first WLAN uses a Wi-Fi Protected Access 2 (WPA2)-compatible authentication protocol and the second WLAN uses a Wi-Fi Protected Access 3 (WPA3)-compatible authentication protocol;
receiving, associated with an electronic device, an association request or a probe request;
establishing a connection with the electronic device using the first WLAN;
when a binding between a passphrase associated with the electronic device and the second WLAN does not exist, establishing the binding in a computer system;
performing a basic service set (BSS) transition of the electronic device from the first WLAN to the second WLAN; and
authenticating the electronic device without a time constraint.
15 . The non-transitory computer-readable storage medium of claim 14 , wherein the operations comprise updating a state entry associated with the electronic device in a state table when the binding is established.
16 . The non-transitory computer-readable storage medium of claim 14 , wherein the operations comprise communicating the state entry to additional computer network devices in a network.
17 . A method for authenticating an electronic device, comprising:
by a computer network device:
providing a first wireless local area network (WLAN) and a second WLAN, wherein the first WLAN uses a Wi-Fi Protected Access 2 (WPA2)-compatible authentication protocol and the second WLAN uses a Wi-Fi Protected Access 3 (WPA3)-compatible authentication protocol;
receiving, associated with the electronic device, an association request or a probe request;
establishing a connection with the electronic device using the first WLAN;
when a binding between a passphrase associated with the electronic device and the second WLAN does not exist, establishing the binding in a computer system;
performing a basic service set (BSS) transition of the electronic device from the first WLAN to the second WLAN; and
authenticating the electronic device without a time constraint.
18 . The method of claim 17 , wherein the method comprises updating a state entry associated with the electronic device in a state table when the binding is established.
19 . The method of claim 18 , wherein the method comprises communicating the state entry to additional computer network devices in a network.
20 . The method of claim 17 , wherein the connection with the electronic device is established using the first WLAN when the connection comprises a first instance of the connection; and
when a request to establish a subsequent instance of a connection with the electronic device occurs, the method comprises establishing the subsequent instance of the connection with the electronic device using the second WLAN based at least in part on a state entry in a state table.