Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2610.14410

RADIUS-Assisted Companion PSK Discovery: Enabling WPA3-SAE in Externally Authenticated Multi-PSK (ePSK / MPSK / DPSK / iPSK / PPSK) Deployments

Azif Abdul Salam Kolisam Beevi·Anil Kumar Reddy·Niraj Lochan Mahapatra
View original source ↗Read source document ↗Export metadata ↓

Abstract

Large multi-dwelling unit (MDU), student-housing and hospitality networks rarely store resident pre-shared keys (PSKs) on the access point (AP). Instead, the per-resident keys of ePSK, MPSK, DPSK, iPSK or PPSK services are held in an external RADIUS server or cloud database synchronised with the property-management system. Our earlier work, Companion-BSSID-Assisted PSK Discovery (CAPD), brought WPA3-SAE to multi-PSK networks by learning the client's PSK on a WPA2-only companion BSSID and steering the client with IEEE 802.11v to a hidden WPA2/WPA3 primary BSSID of the same SSID. CAPD assumes that the AP can test every PSK itself. This paper removes that assumption. We propose RADIUS-Assisted Companion PSK Discovery (RA-CAPD). The AP forwards the ANonce, the raw EAPOL-Key message 2 (SNonce, MIC, RSNE), the SSID, the client MAC, the BSSID and the AP MAC to the external server in RADIUS vendor-specific attributes (VSAs). The server validates the MIC against all provisioned keys, identifies the matching PSK, and returns it encrypted under the RADIUS shared secret (or a per-AP key for cloud databases), together with the unit, room or user identity and the VLAN. The AP binds the client to this PSK and identity, synchronises the binding across all APs in the domain, and moves the client to the configured profile: 802.11v-capable clients via a BSS Transition Management request, and other clients by disconnection and reconnection. On that profile, SAE-capable clients complete WPA3-SAE and WPA2-only clients complete WPA2-PSK, both with the learned key and no further search, so the companion BSSID serves only for onboarding. We present the design, attribute dictionary, algorithms, complexity and security properties, together with laboratory validation on commercial access points.

Explore related subjects

cs.NI

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Azif Abdul Salam Kolisam Beevi, Anil Kumar Reddy, Niraj Lochan Mahapatra. 2026-10-10. RADIUS-Assisted Companion PSK Discovery: Enabling WPA3-SAE in Externally Authenticated Multi-PSK (ePSK / MPSK / DPSK / iPSK / PPSK) Deployments. https://arxiv.org/abs/2610.14410

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Decentralized Decoding with Adaptive Local Combining for Cell-Free Massive MIMO

In existing literature, a two-stage architecture comprising of large-scale fading decoding (LSFD) at the central processing unit (CPU) and local combining at the access points (APs) is commonly deployed for uplink processing in scalable cell-free massive multiple-input multiple-output (CF-mMIMO) systems. However, centralized LSFD (c-LSFD) requires cross-AP channel statistics at the CPU and local combining uses schemes that either do not suppress interference optimally or result in analytically intractable solutions. We provide novel schemes to address both concerns. First, we propose the decentralized LSFD (d-LSFD) scheme that maximizes a surrogate signal-to-interference-plus-noise ratio built only from local interference covariance statistics and identify covariance-action regime where it is equivalent to c-LSFD. Second, based on the fact that the antennas at each AP provide spatial degrees of freedom (DoFs) for both interference suppression and coherent array gain, we interpret every combining scheme as solving the optimal DoF allocation problem over available DoFs. Selective zero-forcing (ZF) schemes solve this problem over both the dimension and composition of the local ZF subspace. We then provide the DoF-adaptive ZF-subspace (DAZS) combining scheme, which lets each AP select the optimal directions in the ZF subspace by maximizing its local sum spectral efficiency. Our numerical results establish the efficacy and efficiency of the proposed schemes compared to the corresponding existing schemes.

cs.NI↗
arXiv2026

Blackbox Performance Analysis of LLM-based Network Control

LLMs are becoming an indispensable part of network control systems due to their impressive reasoning. Before such LLM-enabled systems can be deployed, it is imperative to develop tools that can audit their performance on previously unseen inputs. However, auditing these systems is challenging due to the inherent opacity of LLMs. LENS is the first step towards black-box performance analysis of LLM-enabled network control systems. It uses novel methods to extend deep reinforcement learning to guide the search for performance gaps and inputs that make LLMs struggle. LENS finds large gaps for LLM-based traffic engineering and GPU allocation systems, and even matches existing white-box analyzers designed for hand-crafted TE heuristics.

cs.NI↗
arXiv2026

Semantic Routing Framework for Multi-Domain Telecom Intent-Based Networking

Intent-Based Networking (IBN) is a key enabler of autonomous network management in next-generation networks, as it allows operators to drive the network through high-level intents instead of low-level configuration commands. In this paper, we propose a semantic routing framework for telecom intent classification and translation across the radio access networks (RANs), transport, 5G core, and cloud/edge domains. This framework operates locally to preserve intent privacy and avoid the latency and cost of cloud-based Large Language Model (LLM) solutions. The proposed framework is composed of intent classification and translation. To accurately classify the intent, we propose fine-tuning sentence-transformer models using contrastive learning over a 3GPP TS 28.312-aligned taxonomy of five top-level routes and 22 branches, supported by a telecom-specific codebook of 1,100 intents. In addition, we develop a branchaware, template-driven rule-based module for intent translation that enforces deterministic, hallucination-free parameter extraction and explicit missing-field detection, ensuring a structured and verifiable output pipeline. The numerical results show that the best fine-tuned encoder achieves up to 99.02%/94.61% route/branch classification accuracy, outperforming both base encoders and a commercial embedding baseline. The proposed translator achieves up to 96.24% translation accuracy, compared to 85.37% for a cloud-based LLM benchmark. Moreover, since the proposed pipeline runs entirely on local hardware, an average translation latency of 4.81 ms is recorded against 4,163.58 ms for the cloud-based benchmark, i.e., a speedup of approximately 866x.

cs.NI↗