Authenticating client devices in a wireless communication network with client-specific pre-shared keys

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of an authentication server, causes the one or more processors to perform a method comprising:

• receiving, by the authentication server from an access point associated with a wireless network or a wireless local area network (LAN) controller that manages the access point, an authentication request comprising a first message integrity code (MIC) of a client-specific pre-shared key to establish an encrypted communication channel between a client of a plurality of clients and the access point, wherein the first MIC was generated using a pair-wise master key (PMK) known to the client and one or more attributes including a media access control (MAC) address of the access point;
• and
• responsive to receipt of the authentication request, validating the first MIC by:
• receiving, by the authentication server, the one or more attributes from the access point or the wireless LAN controller;
• determining, by the authentication server, a second MIC based on the client-specific pre-shared key of the client known to the authentication server and the one or more received attributes, wherein the client-specific pre-shared key known to the authentication server is extracted from a key database comprising a plurality of entries, each entry including any or a combination of a MAC address of a specific client of the plurality of clients, a service set identifier (SSID) of the access point, a client-specific pre-shared key assigned by the authentication server to the specific client and a PMK known to the authentication server;
• and
• validating, by the authentication server, the client-specific pre-shared key to be authentic when the first MIC matches with the second MIC.

A system, the system comprising:

• an authentication server;
• and
• a non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource of the authentication server, causes the one or more processors to perform a method comprising:
• receiving, by the authentication server from an access point associated with a wireless network or a wireless local area network (LAN) controller that manages the access point, an authentication request comprising a first message integrity code (MIC) of a client-specific pre-shared key to establish an encrypted communication channel between a client of a plurality of clients and the access point, wherein the first MIC was generated using a pair-wise master key (PMK) known to the client and one or more attributes including a media access control (MAC) address of the access point and a nonce value of the access point;
• and
• responsive to receipt of the authentication request, validating the first MIC by:
• receiving, by the authentication server, the one or more attributes from the access point or the wireless LAN controller;
• determining, by the authentication server, a second MIC based on the client-specific pre-shared key of the client known to the authentication server and the one or more received attributes, wherein the client-specific pre-shared key known to the authentication server is extracted from a key database comprising a plurality of entries, each entry including any or a combination of a MAC address of a specific client of the plurality of clients, a service set identifier (SSID) of the access point, a client-specific pre-shared key assigned by the authentication server to the specific client and a PMK known to the authentication server;
• and
• validating, by the authentication server, the client-specific pre-shared key to be authentic when the first MIC matches with the second MIC.