Mutual authentication between wireless access devices

A first wireless access device associated with a network service provider, comprising:

• one or more memories;
• and
• one or more processors, communicatively coupled to the one or more memories, to:
• establish a wireless local area network (WLAN) connection with a second wireless access device,
• receive a certificate associated with the second wireless access device,
• wherein the certificate includes a unique identifier associated with the second wireless access device;
• provide, after determining whether the certificate is signed by a certificate authority and before performing a mutual authentication procedure with the second wireless access device, and based on determining that the certificate is expired or revoked, limited connectivity to the second wireless access device for one or more destinations that match a destination identifier in a whitelist,
• wherein the one or more destinations correspond to at least one of the certificate authority, or one or more servers that maintain one or more unique identifiers associated with one or more other devices that are paired with the second wireless access device;
• perform, based on providing the limited connectivity to the second wireless access device, the mutual authentication procedure with the second wireless access device based on one or more ephemeral keys,
• wherein performing the mutual authentication procedure with the second wireless access device comprises:
• derive a keyset from one or more shared secrets that are calculated based on a private ephemeral key and a public key included in the certificate;
• calculate a receipt based on the derived keyset;
• and
• determine whether the receipt is verified based on the derived keyset;
• maintain the WLAN connection when the receipt is verified;
• and
• provide the second wireless access device with access to a wide area network (WAN) based on successful completion of the mutual authentication procedure.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors of a first wireless access device associated with a network service provider, cause the one or more processors to:
• establish a wireless local area network (WLAN) connection with a second wireless access device,
• receive a certificate associated with the second wireless access device,
• wherein the certificate includes a unique identifier associated with the second wireless access device;
• provide, after determining whether the certificate is signed by a certificate authority and before performing a mutual authentication procedure with the second wireless access device, and based on determining that the certificate is expired or revoked, limited connectivity to the second wireless access device for one or more destinations that match a destination identifier in a whitelist,
• wherein the one or more destinations correspond to at least one of the certificate authority, or one or more servers that maintain one or more unique identifiers associated with one or more other devices that are paired with the second wireless access device;
• perform, based on providing the limited connectivity to the second wireless access device, the mutual authentication procedure with the second wireless access device based on one or more ephemeral keys based on determining that the second wireless access device is authorized to connect to the first wireless access device,
• wherein performing the mutual authentication procedure with the second wireless access device comprises:
• derive a keyset from one or more shared secrets that are calculated based on a private ephemeral key and a public key included in the certificate;
• calculate a receipt based on the derived keyset;
• and
• determine whether the receipt is verified based on the derived keyset;
• maintain the WLAN connection when the receipt is verified;
• and
• provide the second wireless access device with access to a wide area network (WAN) based on successful completion of the mutual authentication procedure.