Offloading authentication to an authenticator
An electronic device (such as an access point) that selectively performs authentication to a network is described. During operation, the electronic device provides an identity request addressed to the second electronic device. Then, the electronic device receives, associated with the second electronic device, an identity response. In response, when the authentication computer is unavailable, the electronic device accesses, in memory, a predefined hash function and associated authentication parameters for an authentication technique. Next, the electronic device performs authentication with the second electronic device based at least in part on the predefined hash function, where the authentication is compatible with the authentication technique (a type of Extensible Authentication Protocol or EAP). Moreover, the electronic device generates an encryption key, and establishes secure communication with the second electronic device by performing a four-way handshake with the second electronic device based at least in part on the encryption key.
1 . A first electronic device, comprising:
one or more interface circuits configured to communicate with a second electronic device and an authentication computer;
a processor coupled to the interface circuit; and
memory, coupled to the processor, configured to store program instructions, wherein, when executed by the processor, the program instructions cause the first electronic device to perform operations comprising:
providing an identity request addressed to the second electronic device;
receiving, associated with the second electronic device, an identity response;
when the authentication computer is unavailable, accessing, in the memory, a predefined hash function and associated authentication parameters for an authentication technique, wherein the predefined hash function is configured to provide an output based at least in part on an input to the predefined hash function;
performing authentication to a network with the second electronic device based at least in part on the predefined hash function, wherein the authentication is compatible with the authentication technique;
generating an encryption key; and
establishing secure communication with the second electronic device by performing a four-way handshake with the second electronic device based at least in part on the encryption key, wherein the authentication parameters specify a time interval for the predefined hash function; and the operations comprise, after the time interval has elapsed, deleting the predefined hash function.
2 . The first electronic device of claim 1 , wherein the first electronic device comprises an access point.
3 . The first electronic device of claim 1 , wherein the authentication computer comprises a remote authentication dial-in user service (RADIUS) server or an authentication, authorization, and accounting (AAA) server.
4 . The first electronic device of claim 1 , wherein the second electronic device was previously authenticated by the authentication computer and then disconnected from the first electronic device.
5 . The first electronic device of claim 4 , wherein, after the authentication computer authenticated the second electronic device, the operations comprise:
receiving, associated with the authentication computer, the predefined hash function and the authentication parameters, wherein the predefined hash function and the authentication parameters are associated with the second electronic device; and
storing, in the memory, the predefined hash function and the authentication parameters.
6 . The first electronic device of claim 1 , wherein the authentication technique comprises a type of Extensible Authentication Protocol (EAP).
7 . The first electronic device of claim 1 , wherein the operations comprise, prior to providing the identity request, associating with the second electronic device.
8 . The first electronic device of claim 1 , wherein the encryption key comprises a pairwise master key (PMK).
9 . The first electronic device of claim 1 , wherein the authentication parameters specify a time interval for the predefined hash function; and
wherein the operations comprise:
providing, addressed to the authentication computer, a renewal request prior to the time interval elapsing;
receiving, associated with the authentication computer, a second predefined hash function and second authentication parameters; and
storing, in the memory, the second predefined hash function and the second authentication parameters.
10 . The first electronic device of claim 1 , wherein the four-way handshake comprises or is compatible with Extensible Authentication Protocol (EAP) over local area network (EAPol).
11 . The first electronic device of claim 1 , wherein the network comprises a virtual network associated with a location.
12 . The first electronic device of claim 11 , wherein the virtual network comprises: a virtual local area network (VLAN) or a virtual extensible local area network (VXLAN).
13 . A non-transitory computer-readable storage medium for use in conjunction with a first electronic device, the computer-readable storage medium storing program instructions that, when executed by the first electronic device, cause the first electronic device to perform operations comprising:
providing an identity request addressed to a second electronic device;
receiving, associated with the second electronic device, an identity response;
when an authentication computer is unavailable, accessing, in memory in the first electronic device, a predefined hash function and associated authentication parameters for an authentication technique, wherein the predefined hash function is configured to provide an output based at least in part on an input to the predefined hash function;
performing authentication to a network with the second electronic device based at least in part on the predefined hash function, wherein the authentication is compatible with the authentication technique;
generating an encryption key; and
establishing secure communication with the second electronic device by performing a four-way handshake with the second electronic device based at least in part on the encryption key, wherein the authentication parameters specify a time interval for the predefined hash function; and the operations comprise, after the time interval has elapsed, deleting the predefined hash function.
14 . The non-transitory computer-readable storage medium of claim 13 , wherein the first electronic device comprises an access point.
15 . The non-transitory computer-readable storage medium of claim 13 , wherein the second electronic device was previously authenticated by the authentication computer and then disconnected from the first electronic device; and
wherein the operations comprise, after the authentication computer authenticated the second electronic device:
receiving, associated with the authentication computer, the predefined hash function and the authentication parameters, wherein the predefined hash function and the authentication parameters are associated with the second electronic device; and
storing, in the memory, the predefined hash function and the authentication parameters.
16 . A method for selectively perform authentication to a network, comprising:
by a first electronic device:
providing an identity request addressed to a second electronic device;
receiving, associated with the second electronic device, an identity response;
based at least in part on unavailability of an authentication computer, accessing, in memory in the first electronic device, a predefined hash function and associated authentication parameters for an authentication technique, wherein the predefined hash function provides an output based at least in part on an input to the predefined hash function;
performing the authentication with the second electronic device based at least in part on the predefined hash function, wherein the authentication is compatible with the authentication technique;
generating an encryption key; and
establishing secure communication with the second electronic device by performing a four-way handshake with the second electronic device based at least in part on the encryption key, wherein the authentication parameters specify a time interval for the predefined hash function; and the operations comprise, after the time interval has elapsed, deleting the predefined hash function.
17 . The method of claim 16 , wherein the first electronic device comprises an access point.
18 . The method of claim 16 , wherein the second electronic device was previously authenticated by the authentication computer and then disconnected from the first electronic device; and
wherein the method comprises, after the authentication computer authenticated the second electronic device:
receiving, associated with the authentication computer, the predefined hash function and the authentication parameters, wherein the predefined hash function and the authentication parameters are associated with the second electronic device; and
storing, in the memory, the predefined hash function and the authentication parameters.
19 . The method of claim 18 , wherein the authentication parameters specify a time interval for the predefined hash function; and
wherein the method comprises:
providing, addressed to the authentication computer, a renewal request prior to the time interval elapsing;
receiving, associated with the authentication computer, a second predefined hash function and second authentication parameters; and
storing, in the memory, the second predefined hash function and the second authentication parameters.
20 . The method of claim 16 , wherein the second electronic device was previously authenticated by the authentication computer and then disconnected from the first electronic device.