# US 11,310,724 B2 · Key management for fast transitions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,724 B2 - Document ID: US11310724B2 - Status: Granted - Kind: B2 - Application number: 16/090,583 - Filed: 2016-04-01 - Published: 2021-03-11 - Granted: 2022-04-19 - Earliest claimed: 2016-03-31 - Assignees: ARRIS Enterprises LLC - Applicants: ARRIS Enterprises LLC - Inventors: Sheetal Pandey; Tsung-Kai Chen - Web page: https://patentgrep.com/patent/US11310724B2 ## CPC - H04W 48/14: using user query {or user detection} - H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)} - H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/40: Network security protocols - H04W 12/041: Key generation or derivation - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/062: Pre-authentication - H04W 12/069: using certificates or pre-shared keys - H04W 36/0038: {of security context information} - H04L 2209/601: Broadcast encryption - H04L 2209/80: Wireless - H04W 36/08: Reselecting an access point - H04W 84/12: WLAN [Wireless Local Area Networks] - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract When an access point associates with an electronic device, the access point may establish secure communication with the electronic device using a four-way handshake with the electronic device. Next, the access point may distribute secondary pairwise master keys (PMKs) to radio-frequency (RF)-neighbor access points of the access point in a wireless local area network, where the secondary PMKs facilitate fast basic service set (BSS) transitions with the electronic device when a handover occurs without using the four-way handshake to establish secure communication with the electronic device. Furthermore, when the access point receives information that indicates that the electronic device has associated with a second access point in the RF-neighbor access points of the access point, the access point provides instructions to delete the secondary PMKs at the RF-neighbor access points of the access point, and provides additional secondary PMKs to RF-neighbor access points of the second access point. ## Claims ### Claim 1 An access point, comprising: an interface circuit that is configured to communicate with an electronic device and with other access points in a wireless local area network (WLAN), wherein the access point is configured to: determine and store topography information specifying radio-frequency (RF)-neighbor access points for the access point and the other access points based on the communication between the access point and the other access points; when the access point associates with the electronic device, designate the access point as a master access point in the WLAN for the electronic device; generate, based on a pre-shared key (PSK), a pairwise master key (PMK) associated with the access point and the electronic device; using a four-way handshake with the electronic device, calculate a pairwise transient key (PTK) to enable secure communication with the electronic device; generate and distribute secondary PMKs to RF-neighbor access points of the access point based on the topography information, wherein each of the secondary PMKs are unique, and wherein the secondary PMKs facilitate fast basic service set (BSS) transitions with the electronic device when a handover occurs without using the four-way handshake to establish secure communication with the electronic device; receive association information from a second access point in the RE-neighbor access points of the access point that indicates that the electronic device has associated with the second access point; and in response to the association information: provide instructions to delete the secondary PMKs at the RF-neighbor access points of the access point; and provide additional secondary PMKs to RE-neighbor access points of the second access point. ### Claim 2 (depends on 1) The access point of claim 1, wherein the communication between the access point and the other access points comprise wired communication, wireless communication or both. ### Claim 3 (depends on 1) The access point of claim 1, wherein the PSK comprises Extensible Authentication Protocol (EAP) parameters; and wherein the access point obtains the EAP parameters from a server when authenticating the electronic device in the WLAN. ### Claim 4 (depends on 1) The access point of claim 1, wherein the PMK is generated using a secure hashing function based on the PSK. ### Claim 5 (depends on 1) The access point of claim 1, wherein the four-way handshake is compatible with an IEEE 802.11i standard and the fast basic service set (BSS) transitions is compatible with an IEEE 802.11r standard. ### Claim 6 (depends on 1) The access point of claim 1, wherein the RF-neighbor access points of a given access point, which is one of the other access points and the access point, are nearest RF neighbors of the given access point. ### Claim 7 (depends on 1) The access point of claim 1, wherein, when distributing the secondary PMKs, the access point includes information that indicates the access point is the master access point in the WLAN for the electronic device. ### Claim 8 (depends on 1) The access point of claim 1, wherein, when a number of electronic devices associated with the access point exceeds a threshold value and a number of electronic devices associated with the second access point is less than the threshold value, the access point is configured to designate, after receiving the association information, the second access point as the master access point in the WLAN for the electronic device. ### Claim 9 (depends on 1) The access point of claim 1, wherein, when the access point receives one of a disassociate message from the electronic device or a time-out message from the controller, the access point is configured to delete the PMK and is configured to provide instructions to delete the secondary PMKs at the RF-neighbor access points of the access point. ### Claim 10 (depends on 1) The access point of claim 1, wherein the access point further comprises: a processor, coupled to the interface circuit and memory, configured to execute program instructions; and the memory, coupled to the processor, configured to store the program instructions, wherein the program instructions comprise instructions for at least some of the operations performed by the access point. ### Claim 11 A method for facilitating fast handoffs in a wireless local area network (WLAN) that comprises an access point and other access points, wherein the method comprises: determining and storing topography information specifying radio-frequency (RF)-neighbor access points for the access point and the other access points based on the communication between the access point and the other access points; when the access point associates with an electronic device, designating the access point as a master access point in the WLAN for the electronic device; generating, based on a pre-shared key (PSK), a pairwise master key (PMK) associated with the access point and the electronic device; using a four-way handshake with the electronic device, calculating a pairwise transient key (PTK) to enable secure communication with the electronic device; generating and distributing secondary PMKs to RE-neighbor access points of the access point based on the topography information, wherein each of the secondary PMKs are unique, and wherein the secondary PMKs facilitate fast basic service set (BSS) transitions with the electronic device when a handover occurs without using the four-way handshake to establish secure communication with the electronic device; receiving association information from a second access point in the RE-neighbor access points of the access point that indicates that the electronic device has associated with the second access point; and in response to the association information: providing instructions to delete the secondary PMKs at the RE-neighbor access points of the access point; and providing additional secondary PMKs to RF-neighbor access points of the second access point. ### Claim 12 (depends on 11) The method of claim 11, wherein the communication between the access point and the other access points comprise wired communication, wireless communication or both. ### Claim 13 (depends on 11) The method of claim 11, wherein the PSK includes Extensible Authentication Protocol (EAP) parameters; and wherein the method further comprises obtaining the EAP parameters from a server when authenticating the electronic device in the WLAN. ### Claim 14 (depends on 11) The method of claim 11, wherein the PMK is generated using a secure hashing function based on the PSK. ### Claim 15 (depends on 11) The method of claim 11, wherein the four-way handshake is compatible with an IEEE 802.11i standard and the fast basic service set (BSS) transitions is compatible with an IEEE 802.11r standard. ### Claim 16 (depends on 11) The method of claim 11, wherein the RF-neighbor access points of a given access point, which is one of the other access points and the access point, are nearest RF neighbors of the given access point. ### Claim 17 (depends on 11) The method of claim 11, wherein, when distributing the secondary PMKs, the access point includes information that indicates the access point is the master access point in the WLAN for the electronic device. ### Claim 18 (depends on 11) The method of claim 11, wherein, when a number of electronic devices associated with the access point exceeds a threshold value and a number of electronic devices associated with the second access point is less than the threshold value, the method further comprises designating, after receiving the association information, the second access point as the master access point in the WLAN for the electronic device. ### Claim 19 (depends on 11) The method of claim 11, wherein, when the access point receives one of a disassociate message from the electronic device and a time-out message from the controller, the method further comprises deleting the PMK and providing instructions to delete the secondary PMKs at the RE-neighbor access points of the access point. ### Claim 20 A non-transitory computer-readable storage medium for use in conjunction with an access point, the computer-readable storage medium storing program instructions, wherein, when executed by the access point, the program instructions cause the access point to perform operations that facilitate fast handoffs in a wireless local area network (WLAN) that comprises an access point and other access points, the operations comprising: determining and storing topography information specifying radio-frequency (RF)-neighbor access points for the access point and the other access points based on the communication between the access point and the other access points; designating, when the access point associates with an electronic device, the access point as a master access point in the WLAN for the electronic device; generating, based on a pre-shared key (PSK), a pairwise master key (PMK) associated with the access point and the electronic device; calculating, using a four-way handshake with the electronic device, a pairwise transient key (PTK) to enable secure communication with the electronic device; generating and distributing secondary PMKs to RF-neighbor access points of the access point based on the topography information, wherein each of the secondary PMKs are unique, and wherein the secondary PMKs facilitate fast basic service set (BSS) transitions with the electronic device when a handover occurs without using the four-way handshake to establish secure communication with the electronic device; receiving association information from a second access point in the RF-neighbor access points of the access point that indicates that the electronic device has associated with the second access point; and in response to the association information: providing instructions to delete the secondary PMKs at the RF-neighbor access points of the access point; and providing additional secondary PMKs to RE-neighbor access points of the second access point.