US 11,902,775 B2 · Encrypted nonces as rotated device addresses

Abstract

Rotation of a wireless client device address is based on an encryption key and a nonce value. Key information and nonce value information are shared between a wireless client device and a network infrastructure component over a secure communication channel. The wireless client device encrypts the nonce value using the key information and encodes the encrypted value as a device address. The wireless client device then identifies itself via a source address value in a message transmitted over a wireless network. Upon receiving the message, the network infrastructure component decrypts information derived from the source address value and compares the resulting data to the nonce value. If a match is identified, the network infrastructure identifies the wireless client device as a source of the message. In some embodiments, the nonce value is updated with each rotation to provide for improved entropy of generated device addresses.

Claims24

Dependent claims

A method comprising:

establishing a secure communication channel with a wireless client device;
receiving, via the secure communication channel, a decryption key and a first nonce value from the wireless client device;
receiving a first network message indicating a first source address;
in response to determining that the first source address is not present in data for known source addresses in a data store, searching the data store for data associated with devices for which address rotation is impending;
identifying the decryption key and the first nonce value associated with the wireless client device in the data associated with devices for which address rotation is impending based on the searching;
decrypting, using the decryption key, an encrypted value derived from the first source address to obtain a decrypted value;
comparing the decrypted value to the first nonce value;
and
determining the first network message originated from the wireless client device based on the comparing.

6 more elements

An apparatus comprising:

a network interface configured to enable network communications;
one or more processors;
and
one or more memories storing instructions that when executed configure the one or more processors to perform operations comprising:
establishing a secure communication channel with a wireless client device;
receiving, via the secure communication channel, a decryption key and a first nonce value from the wireless client device;
receiving a first network message indicating a first source address;
in response to determining that the first source address is not present in data for known source addresses in the one or more memories, searching the one or more memories for data associated with devices for which address rotation is impending;
identifying the decryption key and the first nonce value associated with the wireless client device in the data associated with devices for which address rotation is impending based on the searching;
decrypting, using the decryption key, an encrypted value derived from the first source address to obtain a decrypted value;
comparing the decrypted value to the first nonce value;
and
determining the first network message originated from the wireless client device based on the comparing.

10 more elements

A non-transitory computer readable storage medium comprising instructions that when executed configure one or more processors to perform operations comprising:

establishing a secure communication channel with a wireless client device;
receiving, via the secure communication channel, a decryption key and a first nonce value from the wireless client device;
receiving a first network message indicating a first source address;
in response to determining that the first source address is not present in data for known source addresses in a data store, searching the data store for data associated with devices for which address rotation is impending;
identifying the decryption key and the first nonce value associated with the wireless client device in the data associated with devices for which address rotation is impending based on the searching;
decrypting, using the decryption key, an encrypted value derived from the first source address to obtain a decrypted value;
comparing the decrypted value to the first nonce value;
and
determining the first network message originated from the wireless client device based on the comparing.

6 more elements

Dependencies are inferred from the claim text.

Encrypted nonces as rotated device addresses

Life of this patent

Encrypted nonces as rotated device addresses

Life of this patent

Abstract

Claims24