Automatic periodic pre-shared key update
During operation, the computer may obtain an access acceptance message, where the access acceptance message indicates that the electronic device has been authenticated and allowed to securely access a network, and where the authentication is based at least in part on a passphrase associated with a user of an electronic device. For example, the computer may receive the acceptance message from the computer network device or a second computer (such as a controller). Alternatively, the computer may obtain the access acceptance message while performing the authentication. Then, the computer may automatically provide a second passphrase addressed to a computer network device and the electronic device, where the second passphrase replaces the passphrase during a current session of the electronic device in the network. Moreover, when the current session ends, the computer may automatically revert to the passphrase for subsequent authentication of the user.
1. A computer, comprising:
an interface circuit configured to communicate with a computer network device and an electronic device;
a processor coupled to the interface circuit; and
memory, coupled to the processor, configured to store program instructions, wherein, when executed by the processor, the program instructions cause the computer to perform operations comprising:
obtaining an access acceptance message, wherein the access acceptance message indicates that the electronic device has been authenticated and allowed to securely access a network, and wherein the authentication is based at least in part on a passphrase associated with a user of the electronic device;
automatically providing a second passphrase addressed to the computer network device and the electronic device, wherein the second passphrase replaces the passphrase during a current session of the electronic device in the network; and
when the current session ends, automatically reverting to the passphrase for subsequent authentication of the user, wherein the passphrase comprises a dynamic pre-shared key (DPSK) of the electronic device; and
wherein the authentication is compatible with Wi-Fi Protected Access (WPA) WPA3 and is based at least in part on a binding between the passphrase and the network.
2. The computer of claim 1 , wherein the operations comprise receiving, associated with the computer network device or a second computer, the acceptance message.
3. The computer of claim 2 , wherein the second computer comprises a controller of the computer network device or an authentication, authorization, and accounting (AAA) server.
4. The computer of claim 1 , wherein obtaining the access acceptance message comprises:
receiving an access request associated with the electronic device and via the computer network device, wherein the access request comprises passphrase parameters corresponding to the passphrase, and the passphrase parameters comprise inputs to a cryptographic calculation and an output of the cryptographic calculation;
calculating one or more second outputs of the cryptographic calculation based at least in part on the inputs and one or more stored passphrases; and
when there is a match between one of the one or more second outputs and the output, selectively providing, addressed to the electronic device and via the computer network device, the access acceptance message, wherein the access acceptance message includes information for establishing the secure access of the electronic device to the network.
5. The computer of claim 4 , wherein the passphrase parameters comprise one or more of: a random number associated with the electronic device, a random number associated with the computer network device, the output of the cryptographic calculation, the identifier of the electronic device, or an identifier of the computer network device.
6. The computer of claim 1 , wherein the second passphrase is automatically provided after a predefined time interval has elapsed after successful authentication of the electronic device.
7. The computer of claim 1 , wherein the automatic providing of the second passphrase comprises:
generating the second passphrase; or
selecting the second passphrase from a set of predefined or predetermined second passphrases.
8. The computer of claim 1 , wherein the computer network device comprises an access point, a router or a switch.
9. The computer of claim 1 , wherein the network comprises a wireless local area network (WLAN) or a virtual network that may be associated with a location.
10. The computer of claim 1 , wherein the authentication is compatible with one or more of: Wi-Fi Protected Access (WPA), WPA2 or WPA3.
11. A non-transitory computer-readable storage medium for use in conjunction with a computer, the computer-readable storage medium storing program instructions that, when executed by the computer, cause the computer to perform operations comprising:
obtaining an access acceptance message, wherein the access acceptance message indicates that an electronic device has been authenticated and allowed to securely access a network, and wherein the authentication is based at least in part on a passphrase associated with a user of the electronic device;
automatically providing a second passphrase addressed to a computer network device and the electronic device, wherein the second passphrase replaces the passphrase during a current session of the electronic device in the network; and
when the current session ends, automatically reverting to the passphrase for subsequent authentication of the user, wherein the passphrase comprises a dynamic pre-shared key (DPSK) of the electronic device; and
wherein the authentication is compatible with Wi-Fi Protected Access (WPA) WPA3 and is based at least in part on a binding between the passphrase and the network.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the second passphrase is automatically provided after a predefined time interval has elapsed after successful authentication of the electronic device.
13. The non-transitory computer-readable storage medium of claim 11 , wherein the automatic providing of the second passphrase comprises:
generating the second passphrase; or
selecting the second passphrase from a set of predefined or predetermined second passphrases.
14. The non-transitory computer-readable storage medium of claim 11 , wherein obtaining the access acceptance message comprises:
receiving an access request associated with the electronic device and via the computer network device, wherein the access request comprises passphrase parameters corresponding to the passphrase, and the passphrase parameters comprise inputs to a cryptographic calculation and an output of the cryptographic calculation;
calculating one or more second outputs of the cryptographic calculation based at least in part on the inputs and one or more stored passphrases; and
when there is a match between one of the one or more second outputs and the output, selectively providing, addressed to the electronic device and via the computer network device, the access acceptance message, wherein the access acceptance message includes information for establishing the secure access of the electronic device to the network.
15. A method for automatically updating a passphrase, comprising:
by a computer:
obtaining an access acceptance message, wherein the access acceptance message indicates that an electronic device has been authenticated and allowed to securely access a network, and wherein the authentication is based at least in part on the passphrase associated with a user of the electronic device;
automatically providing a second passphrase addressed to a computer network device and the electronic device, wherein the second passphrase replaces the passphrase during a current session of the electronic device in the network; and
when the current session ends, automatically reverting to the passphrase for subsequent authentication of the user, wherein the passphrase comprises a dynamic pre-shared key (DPSK) of the electronic device; and
wherein the authentication is compatible with Wi-Fi Protected Access (WPA) WPA3 and is based at least in part on a binding between the passphrase and the network.
16. The method of claim 15 , wherein the second passphrase is automatically provided after a predefined time interval has elapsed after successful authentication of the electronic device.
17. The method of claim 15 , wherein the automatic providing of the second passphrase comprises:
generating the second passphrase; or
selecting the second passphrase from a set of predefined or predetermined second passphrases.
18. The method of claim 15 , wherein obtaining the access acceptance message comprises:
receiving an access request associated with the electronic device and via the computer network device, wherein the access request comprises passphrase parameters corresponding to the passphrase, and the passphrase parameters comprise inputs to a cryptographic calculation and an output of the cryptographic calculation;
calculating one or more second outputs of the cryptographic calculation based at least in part on the inputs and one or more stored passphrases; and
when there is a match between one of the one or more second outputs and the output, selectively providing, addressed to the electronic device and via the computer network device, the access acceptance message, wherein the access acceptance message includes information for establishing the secure access of the electronic device to the network.
19. The method of claim 15 , wherein the second computer comprises a controller of the computer network device or an authentication, authorization, and accounting (AAA) server.