Radius helps access points securely find resident keys in shared wifi networks
RADIUS-Assisted Companion PSK Discovery: Enabling WPA3-SAE in Externally Authenticated Multi-PSK (ePSK / MPSK / DPSK / iPSK / PPSK) Deployments
Networking and Internet Architecture
Summary
Many apartment buildings and hotels use Wi-Fi networks where each resident has a unique password stored on an external server, not the Wi-Fi device itself. This makes it hard to connect new devices using the latest secure Wi-Fi methods. The authors present a way for the Wi-Fi device to ask the external server to identify a resident’s password during connection setup, so the device can securely connect using newer Wi-Fi standards without testing every password locally. They tested this method in the lab and showed it works with existing Wi-Fi devices.
What this means in practice
- •For network administrators: Enable centralized secure Wi-Fi authentication in large residential or hospitality buildings without storing keys on access points.
- •For cloud service providers: Offer external authentication services that integrate with Wi-Fi access points to support WPA3 in multi-key environments.$Commercial implications: This paper enables a product to securely manage resident Wi-Fi keys and provide WPA3 support for multi-PSK deployments.
Authors
Azif Abdul Salam Kolisam Beevi, Anil Kumar Reddy, Niraj Lochan Mahapatra
Abstract
Large multi-dwelling unit (MDU), student-housing and hospitality networks rarely store resident pre-shared keys (PSKs) on the access point (AP). Instead, the per-resident keys of ePSK, MPSK, DPSK, iPSK or PPSK services are held in an external RADIUS server or cloud database synchronised with the property-management system. Our earlier work, Companion-BSSID-Assisted PSK Discovery (CAPD), brought WPA3-SAE to multi-PSK networks by learning the client's PSK on a WPA2-only companion BSSID and steering the client with IEEE 802.11v to a hidden WPA2/WPA3 primary BSSID of the same SSID. CAPD assumes that the AP can test every PSK itself. This paper removes that assumption. We propose RADIUS-Assisted Companion PSK Discovery (RA-CAPD). The AP forwards the ANonce, the raw EAPOL-Key message 2 (SNonce, MIC, RSNE), the SSID, the client MAC, the BSSID and the AP MAC to the external server in RADIUS vendor-specific attributes (VSAs). The server validates the MIC against all provisioned keys, identifies the matching PSK, and returns it encrypted under the RADIUS shared secret (or a per-AP key for cloud databases), together with the unit, room or user identity and the VLAN. The AP binds the client to this PSK and identity, synchronises the binding across all APs in the domain, and moves the client to the configured profile: 802.11v-capable clients via a BSS Transition Management request, and other clients by disconnection and reconnection. On that profile, SAE-capable clients complete WPA3-SAE and WPA2-only clients complete WPA2-PSK, both with the learned key and no further search, so the companion BSSID serves only for onboarding. We present the design, attribute dictionary, algorithms, complexity and security properties, together with laboratory validation on commercial access points.