# US 10,313,351 B2 · Dynamic passcodes in association with a wireless access point

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,351 B2
- Document ID: US10313351B2
- Status: Granted
- Kind: B2
- Application number: 15/049,773
- Filed: 2016-02-22
- Published: 2017-08-24
- Granted: 2019-06-04
- Earliest claimed: 2016-02-22
- Assignees: AT&T Intellectual Property I, L.P.; AT&T Mobility II LLC
- Applicants: At&T Intellectual Property I, L.P.; At&T Mobility II LLC
- Inventors: Sheldon Kent Meredith; William Cottrill; Brandon B. Hilliard
- Web page: https://patentgrep.com/patent/US10313351B2

## CPC

- H04L 63/101: {Access control lists [ACL]}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0838: {using one-time-passwords}
- H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords}
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- H04W 12/06: Authentication
- H04W 12/08: Access security
- H04L 2463/062: applying encryption of the keys
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A method includes, after expiration of a first passcode, receiving, at an access point, a first access request from a first device. The first access request may be encrypted based on the first passcode. The method further includes determining whether an identifier of the first device is included in a device list associated with the first passcode. The device list includes identifiers of devices that accessed the access point using encryption based on the first passcode before the expiration of the first passcode. The method also includes, in response to a determination that the identifier of the first device is included in the device list generating, at the access point, data representing a second passcode by encrypting the second passcode using the first passcode. The method further includes sending the data representing the second passcode to the first device from the access point.

## Claims

### Claim 1

A method comprising:
during a usage period of a first passcode that enables access to a network and for an initial access request during the usage period for each user device that sends a valid access request to access the network based on the first passcode during the usage period, adding, at an access point, an identifier of the user device to a device list for the first passcode;
after expiration of the first passcode, receiving, at the access point, a first access request from a first device, the first access request encrypted based on the first passcode;
in response to the first access request and before expiration of a usage time of the device list for the first passcode, determining at the access point, whether an identifier of the first device is included in the device list for the first passcode; and
in response to the determining indicating that the identifier of the first device is included in the device list for the first passcode:
generating, at the access point, data representing a second passcode by encrypting the second passcode based on the first passcode;
sending the data representing the second passcode to the first device from the access point; and
removing, at the access point, the identifier for the first device from the device list for the first passcode.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
before the expiration of the first passcode, receiving a second access request from the first device, the second access request encrypted based on the first passcode;
determining, based on the second access request, whether the identifier of the first device is included in a trusted devices list; and
in response to the trusted devices list including the identifier of the first device, enabling the identifier of the first device to be included in the device list for the first passcode.

### Claim 3 (depends on 2)

The method of claim 2, wherein the trusted devices list includes identifiers of devices designated as trusted devices by an administrator of a local area network supported by the access point.

### Claim 4 (depends on 2)

The method of claim 2, further comprising, in response to expiration of the usage time of the device list for the first passcode:
removing, from the trusted devices list, first identifiers corresponding to the identifiers in the device list; and
inhibiting subsequent access to the device list for the first passcode.

### Claim 5 (depends on 4)

The method of claim 4, wherein the inhibiting subsequent access to the device list for the first passcode comprises deleting the device list for the first passcode from a memory of the access point.

### Claim 6 (depends on 2)

The method of claim 2, further comprising, in response to the trusted devices list not including the identifier of the first device, blocking addition of the identifier of the first device to the device list for the first passcode.

### Claim 7 (depends on 1)

The method of claim 1, further comprising, after the expiration of the first passcode and during the usage time of the device list for the first passcode:
receiving, at the access point, a second access request from a second device, the second access request encrypted based on the first passcode; and
in response to a second determination that an identifier of the second device is not included in the device list for the first passcode, denying the second access request.

### Claim 8 (depends on 1)

The method of claim 1, further comprising, after the expiration of the first passcode and the expiration of the usage time of the device list for the first passcode:
receiving a second access request, the second access request based on the first passcode; and
denying the second access request.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
receiving, from a device associated with an administrator of a local area network supported by the access point, an indication to add a particular device to a trusted devices list for devices configured to generate updated passcodes; and
responsive to the indication, sending passcode generation data to the particular device, wherein the passcode generation data enables the particular device to generate a valid passcode based on a previously valid passcode.

### Claim 10 (depends on 1)

The method of claim 1, wherein the access point generates the second passcode by applying a polynomial to the first passcode.

### Claim 11

A system comprising:
a processor of an access point;
a memory coupled to the processor, the memory including instructions executable by the processor to perform operations, the operations including:
during a usage period of a first passcode that enables access to a network and for an initial access request during the usage period for each user device that sends a valid access request to access the network based on the first passcode during the usage period, adding an identifier of the user device to a device list for the first passcode;
after expiration of the first passcode, receiving, from a first device, a first access request to access a local area network, the first access request encrypted based on the first passcode;
in response to the first access request and before expiration of a usage time of the device list for the first passcode, determining whether an identifier of the first device is included in the device list for the first passcode; and
in response to the determining indicating that the identifier of the first device is included in the device list for the first passcode:
generating data representing a second passcode by encrypting the second passcode based on the first passcode;
sending the data representing the second passcode to the first device; and
removing, at the access point, the identifier for the first device from the device list for the first passcode.

### Claim 12 (depends on 11)

The system of claim 11, wherein the operations further include:
receiving, from a device associated with a network administrator of the local area network, a first instruction to add an identifier associated with a second device to a trusted devices list; and
based on the first instruction, adding the identifier of the second device to the trusted devices list.

### Claim 13 (depends on 11)

The system of claim 11, wherein the operations further include:
receiving, from a device associated with a network administrator of the local area network, a first instruction to add an identifier associated with a third device to a trusted devices list for devices configured to generate updated passcodes; and
based on the first instruction, sending first passcode generation data to the third device, wherein the first passcode generation data enables the third device to generate a valid passcode based on a previously valid passcode.

### Claim 14 (depends on 13)

The system of claim 13, wherein the operations further include:
in response to a determination to remove an entry for a particular device from the trusted devices list for devices configured to generate updated passcodes:
sending second passcode generation data to each device identified in the trusted devices list after removal of the entry for the particular device from the trusted devices list; and
generating a new passcode using the second passcode generation data and a previous passcode, wherein the new passcode cannot be generated using the first passcode generation data and the previous passcode.

### Claim 15

A processor-readable storage device storing instructions that, when executed by a processor of an access point, cause the processor to perform operations, the operations comprising:
during a usage period of a first passcode that enables access to a network and for an initial access request during the usage period for each user device that sends a valid access request to access the network based on the first passcode during the usage period, adding an identifier of the user device to a device list for the first passcode;
after expiration of the first passcode, receiving a first access request from a first device, the first access request encrypted based on the first passcode;
in response to the first access request and before expiration of a usage time of the device list for the first passcode, determining whether that an identifier of the first device is included in the device list for the first passcode; and
in response to the determining indicating that the identifier of the first device is included in the device list for the first passcode:
generating data representing a second passcode by encrypting the second passcode based on the first passcode;
sending the data representing the second passcode to the first device; and
removing, at the access point, the identifier for the first device from the device list for the first passcode.

### Claim 16 (depends on 15)

The processor-readable storage device of claim 15, wherein the operations further comprise:
before the expiration of the first passcode, receiving a second access request from the first device, the second access request encrypted based on the first passcode;
determining, based on the second access request, whether the identifier of the first device is included in a trusted devices list; and
in response to the trusted devices list including the identifier of the first device, enabling the identifier of the first device to be included in the device list for the first passcode.

### Claim 17 (depends on 16)

The processor-readable storage device of claim 16, wherein the operations further comprise:
in response to expiration of the usage time of the device list for the first passcode:
removing, from the trusted devices list, first identifiers corresponding to the identifiers in the device list for the first passcode; and
inhibiting subsequent access to the device list for the first passcode.

### Claim 18 (depends on 15)

The processor-readable storage device of claim 15, wherein the operations further comprise, in response to the determining that the identifier of the first device is included in the device list for the first passcode, deleting an entry associated with the first device from the device list for the first passcode.

### Claim 19 (depends on 15)

The processor-readable storage device of claim 15, wherein the first access request is a portion of a handshake procedure.

### Claim 20 (depends on 15)

The processor-readable storage device of claim 15, wherein each device identified in the device list for the first passcode is also identified in a trusted devices list.