Secured key exchange for wireless local area network (WLAN) zero configuration

An apparatus configured as an access point in a wireless network, comprising:

• a processor;
• computer memory holding computer program instructions executed by the processor, the computer program instructions comprising program code configured to:
• output a first public key of a first cryptographic key pair, the first cryptographic key pair uniquely associated with the AP, the first public key output in a first element of a management frame issued from the AP, the management frame also including a second element distinct from the first element and that includes a portion of the first public key;
• receive a second public key of a second cryptographic key pair, the second cryptographic key pair uniquely associated with a mobile station (STA) seeking to associate with the AP, the second public key output in a management frame issued from the STA;
• compute a shared secret using the second public key received from the STA and a private key of the first cryptographic key pair, the shared secret thereafter being uniquely associated with the AP and STA pair;
• and
• use the shared secret to complete a handshake between the AP and the STA, thereby setting up a secure communication link between the AP and STA pair.

A computer program product in a non-transitory computer readable medium for use in a data processing system configured as an access point a wireless network, the computer program product holding computer program instructions executed by the data processing system, the computer program instructions comprising program code configured to:

• output a first public key of a first cryptographic key pair, the first cryptographic key pair uniquely associated with the AP, the first public key output in a first element of a management frame issued from the AP, the management frame also including a second element distinct from the first element and that includes a portion of the first public key;
• receive a second public key of a second cryptographic key pair, the second cryptographic key pair uniquely associated with a mobile station (STA) seeking to associate with the AP, the second public key output in a management frame issued from the STA;
• compute a shared secret using the second public key received from the STA and a private key of the first cryptographic key pair, the shared secret thereafter being uniquely associated with the AP and STA pair;
• and
• use the shared secret to complete a handshake between the AP and the STA, thereby setting up a secure communication link between the AP and STA pair.

An apparatus configured as a mobile station (STA) operating in a wireless network, comprising:

• a processor;
• computer memory holding computer program instructions executed by the processor, the computer program instructions comprising program code configured to:
• receive a first public key of a first cryptographic key pair, the first cryptographic key pair uniquely associated with an access point (AP) to which the STA seeks to associate, the first public key having been output in a first element of a management frame issued from the AP, the management frame also including a second element distinct from the first element and that includes a portion of the first public key;
• output a second public key of a second cryptographic key pair, the second cryptographic key pair uniquely associated with the STA, the second public key output in a management frame issued from the STA;
• compute a shared secret using the first public key received from the AP and a private key of the second cryptographic key pair, the shared secret thereafter being uniquely associated with the AP and STA pair;
• and
• use the shared secret to complete a handshake between the AP and the STA, thereby setting up a secure communication link between the AP and STA pair.