AUTHENTICATION BY A LOCAL AUTHENTICATOR
An electronic device (such as an access point or a local electronic device in a common environment with a second electronic device) that performs authentication to a network is described. During operation, the electronic device may receive, from an authentication computer, authentication information. For example, the authentication information may include a dynamic pre-shared key (DPSK) associated with the second electronic device. Then, the electronic device may receive, from the second electronic device, an authentication request. Next, at least while communication with the authentication computer is available, the electronic device may perform authentication of the second electronic device to a network based at least in part on the authentication information.
1 . An electronic device, comprising:
one or more interface circuits configured to communicate with a second electronic device and an authentication computer;
a processor coupled to the interface circuit; and
memory, coupled to the processor, configured to store program instructions, wherein, when executed by the processor, the program instructions cause the electronic device to perform operations comprising:
receiving, associated with the authentication computer, authentication information;
receiving, associated with the second electronic device, an authentication request; and
at least while communication with the authentication computer is available, performing authentication of the second electronic device to a network based at least in part on the authentication information.
2 . The electronic device of claim 1 , wherein, after performing the authentication, the operations comprise:
generating an encryption key; and
establishing secure communication with the second electronic device by performing a four-way handshake with the second electronic device based at least in part on the encryption key.
3 . The electronic device of claim 2 , wherein the encryption key comprises a pairwise master key (PMK).
4 . The electronic device of claim 2 , wherein the four-way handshake comprises or is compatible with Extensible Authentication Protocol (EAP) over local area network (EAPol).
5 . The electronic device of claim 1 , wherein, prior to receiving the authentication request, the operations comprise:
providing an identity request addressed to the second electronic device; and
receiving, associated with the second electronic device, an identity response.
6 . The electronic device of claim 1 , wherein the electronic device is located in a common environment as the second electronic device.
7 . The electronic device of claim 6 , wherein the authentication computer is remotely located from the electronic device and the second electronic device.
8 . The electronic device of claim 1 , wherein the authentication information comprises a dynamic pre-shared key (DPSK) associated with the second electronic device.
9 . The electronic device of claim 1 , wherein the authentication information comprises an expiration date of the authentication information.
10 . The electronic device of claim 1 , wherein the authentication information comprises an identifier of a virtual local area network (VLAN) or a virtual extensible local area network (VXLAN).
11 . The electronic device of claim 1 , wherein the electronic device comprises an access point.
12 . The electronic device of claim 1 , wherein the authentication computer comprises a remote authentication dial-in user service (RADIUS) server or an authentication, authorization, and accounting (AAA) server.
13 . The electronic device of claim 1 , wherein, after the receiving authentication information, the operations comprise storing, in the memory, the authentication information; and
wherein, after receiving the authentication request and prior to performing the authentication, the operations comprise accessing the stored authentication information in the memory.
14 . The electronic device of claim 1 , wherein the authentication is compatible with a type of Extensible Authentication Protocol (EAP).
15 . The electronic device of claim 1 , wherein, prior to performing the authentication, the operations comprise associating with the second electronic device.
16 . The electronic device of claim 1 , wherein the network comprises a virtual network associated with a location.
17 . The electronic device of claim 12 , wherein the virtual network comprises: a virtual local area network (VLAN) or a virtual extensible local area network (VXLAN).
18 . A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions that, when executed by the electronic device, cause the electronic device to perform operations comprising:
receiving, associated with the authentication computer, authentication information;
receiving, associated with the second electronic device, an authentication request; and
at least while communication with the authentication computer is available, performing authentication of the second electronic device to a network based at least in part on the authentication information.
19 . A method for performing authentication a network, comprising:
by an electronic device:
receiving, associated with an authentication computer, authentication information;
receiving, associated with a second electronic device, an authentication request; and
at least while communication with the authentication computer is available, performing authentication to the network of the second electronic device based at least in part on the authentication information.
20 . The method of claim 19 , wherein the electronic device comprises an access point.