Enhanced secure provisioning for hotspots

An access point comprising:

• one or more processors;
• and
• a memory comprising instructions stored thereon that, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising:
• generating a master secret and a first public key-private key pair, the first public key-private key pair comprising an access point private key;
• deploying the master secret and the first public key-private key pair to an intermediate device accessible to a client device;
• receiving an association request from the client device, the association request including an encrypted nonce public key and a device signature;
• decrypting the encrypted nonce public key using the master secret;
• verifying the device signature using the decrypted nonce public key;
• generating an access point ephemeral public key-private key pair;
• encrypting an access point signature with an access point private key;
• providing an access point ephemeral public key of the access point ephemeral public key-private key pair and the encrypted access point signature to the client device;
• and
• initiating an association with the client device using one or more ephemeral keys exchanged with the client device.

A method comprising:

• receiving, by a device, a ticket from an intermediate device, the ticket comprising a nonce private key, an encrypted nonce public key, an access point public key, and an expiration time associated with the ticket;
• generating, by the device, a device ephemeral public key-private key pair;
• generating, by the device, a random challenge;
• encrypting, by the device, a device signature using the nonce private key;
• providing, by the device to an access point, the encrypted nonce public key, a device ephemeral public key of the device ephemeral public key-private key pair, the random challenge, and the encrypted device signature;
• receiving an access point signature from the access point;
• verifying the access point signature using the access point public key;
• and
• obtaining access to a network associated with the access point by an association with the access point.