Mesh network with personal pre-shared keys
View Patent ↗A mesh network with a network-wide pre-shared key (PSK) that can be updated is described. The PSK can be used to establish secure communication between arbitrary electronic devices in the mesh network. In order to prevent electronic devices from being inadvertently ‘stranded,’ i.e., unable to securely communicate with other electronic devices in the mesh network when the PSK is updated, pairs of electronic devices in the mesh network establish personal PSKs (PPSKs). In particular, after securely associating with each other, a given pair of electronic devices may have used the current PSK to authenticate and encrypt their communication. Then, the given pair of electronic devices may define a PPSK, e.g., by exchanging one or more random numbers. If a subsequent attempt at establishing secure or encrypted communication between the given pair of electronic devices fails, these electronic devices may use the PPSK as a backup to establish the encrypted communication.
1. An electronic device, comprising:
an interface circuit configured to communicate with other electronic devices, wherein a path to a root electronic device in the other electronic devices, which is coupled to a network, contains at least one wireless connection that passes information from a client device to the network via an access point, wherein the electronic device is configured to:
receive a pre-shared key (PSK) from a controller;
establish encrypted communication with a first electronic device in the other electronic devices using the PSK;
exchange a first personal pre-shared key (PPSK) with the first electronic device, wherein the first PPSK is associated with the electronic device and the first electronic device, and wherein exchanging the first PPSK involves one of: providing at least a first portion of the first PPSK to the first electronic device, and receiving at least a second portion of the first PPSK to the first electronic device;
when a subsequent attempt to establish encrypted communication with the first electronic device using the PSK fails, establish encrypted communication with the first electronic device using the first PPSK; and
when the subsequent attempt to establish encrypted communication with the first electronic device using the PSK succeeds, perform encrypted communication with the first electronic device using the PSK, wherein the electronic device is an arbitrary member of a group of electronic devices that includes the electronic device and the other electronic devices.
2. The electronic device of claim 1 , wherein the encrypted communication includes Wi-Fi Protected Access.
3. The electronic device of claim 1 , wherein the first PPSK includes one or more random numbers.
4. The electronic device of claim 1 , wherein the first PPSK is valid during a time interval.
5. The electronic device of claim 1 , wherein the electronic device is further configured to provide the first PPSK to a second electronic device in the other electronic devices.
6. The electronic device of claim 1 , wherein the electronic device is further configured to:
establish encrypted communication with a second electronic device in the other electronic devices using the PSK; and
exchange a second PPSK with the second electronic device, wherein the second PPSK is associated with the electronic device and the second electronic device; and
wherein the electronic device is configured to establish encrypted communication with the second electronic device using the second PPSK when a subsequent attempt to establish encrypted communication with the second electronic device using the PSK fails.
7. The electronic device of claim 1 , wherein the electronic device further comprises an antenna coupled to the interface circuit.
8. The electronic device of claim 1 , wherein the electronic device further comprises:
a processor; and
a memory, coupled to the processor, which stores a program module configured to be executed by the processor, wherein, when executed by the processor, the program module causes the electronic device to perform:
the establishing; and
the exchanging.
9. A computer-program product for use in conjunction with an electronic device, the computer-program product comprising a non-transitory computer-readable storage medium and a program module embedded therein to exchange a personal pre-shared key (PPSK), wherein, when executed by the processor, the program module causes the electronic device to:
receive a pre-shared key (PSK) from a controller;
establish encrypted communication with a first electronic device in other electronic devices using the PSK, wherein a path to a root electronic device in the other electronic devices, which is coupled to a network, contains at least one wireless connection that passes information from a client device to the network via an access point;
exchange a first PPSK with the first electronic device, wherein the first PPSK is associated with the electronic device and the first electronic device, and wherein exchanging the first PPSK involves one of: providing at least a first portion of the first PPSK to the first electronic device, and receiving at least a second portion of the first PPSK to the first electronic device;
establish encrypted communication with the first electronic device using the first PPSK when a subsequent attempt to establish encrypted communication with the first electronic device using the PSK fails; and
perform encrypted communication with the first electronic device using the PSK when the subsequent attempt to establish encrypted communication with the first electronic device using the PSK succeeds, wherein the electronic device is an arbitrary member of a group of electronic devices that includes the electronic device and the other electronic devices.
10. The computer-program product of claim 9 , wherein the first PPSK includes one or more random numbers.
11. The computer-program product of claim 9 , wherein the first PPSK is valid during a time interval.
12. The computer-program product of claim 9 , wherein, when executed by the electronic device, the program module causes the electronic device to:
establish encrypted communication with a second electronic device in the other electronic devices using the PSK;
exchange a second PPSK with the second electronic device, wherein the second PPSK is specific to the electronic device and the second electronic device; and
establish encrypted communication with the second electronic device using the second PPSK when a subsequent attempt to establish encrypted communication with the second electronic device using the PSK fails.
13. A method for exchanging a personal pre-shared key (PPSK) using an electronic device, wherein the method comprises:
receiving a pre-shared key (PSK);
establishing encrypted communication with a first electronic device in other electronic devices using the PSK, wherein a path to a root electronic device in the other electronic, which is coupled to a network, contains at least one wireless connection that passes information from a client device to the network via an access point;
exchanging a first PPSK with the first electronic device, wherein the first PPSK is associated with the electronic device and the first electronic device, and wherein exchanging the first PPSK involves one of: providing at least a first portion of the first PPSK to the first electronic device, and receiving at least a second portion of the first PPSK to the first electronic device;
when a subsequent attempt to establish encrypted communication with the first electronic device using the PSK fails, establishing encrypted communication with the first electronic device using the first PPSK; and
when the subsequent attempt to establish encrypted communication with the first electronic device using the PSK succeeds, performing encrypted communication with the first electronic device using the PSK, wherein the electronic device is an arbitrary member of a group of electronic devices that includes the electronic device and the other electronic devices.
14. The method of claim 13 , wherein the encrypted communication includes Wi-Fi Protected Access.
15. The method of claim 13 , wherein the first PPSK includes one or more random numbers.
16. The method of claim 13 , wherein the first PPSK is valid during a time interval.
17. The method of claim 13 , wherein the method further comprises providing the first PPSK to a second electronic device in the other electronic devices.
18. The method of claim 13 , wherein the method further comprises:
establishing encrypted communication with a second electronic device in the other electronic devices using the PSK;
exchanging a second PPSK with the second electronic device, wherein the second PPSK is associated with the electronic device and the second electronic device; and
establishing encrypted communication with the second electronic device using the second PPSK when a subsequent attempt to establish encrypted communication with the second electronic device using the PSK fails.