Management frame transmission method and device of wireless local area network, and wireless local area network

Abstract

The invention discloses a WLAN (Wireless Local Area Network) management frame transmission method and device and a WLAN, and belongs to the technical field of wireless communication. The AP sends a first operation type management frame, the frame body of the first operation type management frame comprises a first encryption field, the first encryption field is encrypted by a first key, and the first operation type management frame is a beacon frame, a detection response frame, an authentication response frame, an association response frame or a re-association response frame. According to the embodiment of the invention, the first key is preset in the AP, so that the AP can encrypt the frame body of the sent first operation type management frame by using the preset first key, thereby realizing encrypted transmission of the management frame sent by the AP before successful association between the AP and the STA, and improving the safety of WLAN communication.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, and in particular to a management frame transmission method and device for a wireless local area network (WLAN), and a wireless local area network. Background Art

[0002] WLAN includes access points (AP) and stations (STA). AP is used to provide bridging function between WLAN and other types of networks (such as wired networks). STA refers to wireless terminals configured with WLAN access function, such as smartphones and laptops. AP announces the existence of WLAN by periodically broadcasting beacon frames. STA can sense the existence of AP based on the received beacon frames and access WLAN by associating with the sensed AP.

[0003] However, due to the open channel feature of WLAN, the beacon frames broadcast by AP and other management frames transmitted between STA and AP during the association process are easily eavesdropped by attackers, resulting in network information leakage. How to improve the transmission security of management frames in WLAN is the premise and key to improving WLAN communication security. Summary of the invention

[0004] The present application provides a WLAN management frame transmission method and device, and a wireless local area network.

[0005] In a first aspect, a management frame transmission method for a WLAN is provided. The method includes: an AP sends a first operation-type management frame, a frame body of the first operation-type management frame includes a first encryption field, the first encryption field is encrypted by a first key, and the first operation-type management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame.

[0006] The present application pre-sets a key in the AP so that the AP can use the preset key to encrypt the frame body of the first operation type management frame it sends, thereby realizing encrypted transmission of the management frame sent by the AP before the AP successfully associates with the STA, thereby improving the security of WLAN communications.

[0007] Optionally, the first key is pre-stored in a non-volatile memory or a hardware encryption device of the AP, wherein the non-volatile memory or the hardware encryption device may be built in the AP, or the AP may be connected to an external non-volatile memory or hardware encryption device.

[0008] Optionally, the first operation class management frame is a beacon frame, and one or more of a timestamp field, a beacon interval field, a capability information field, a transmission indication mapping field, or a channel switching announcement field of the frame body of the beacon frame are outside the first encryption field.

[0009] Optionally, the first operation class management frame is a beacon frame, and the frame body of the first operation class management frame carries a first check value, which is calculated by the AP for a first field to be checked in the frame body of the first operation class management frame, and the first check value is used to perform integrity check on the first field to be checked, and the first field to be checked includes a supported rate and basic service set (basic service set, BSS) member selection field, a direct sequence spread spectrum parameter set field, a power constraint field, a silence field, an extended rate physical layer field, an extended supported rate and BSS member selection field, a multiple BSS identifier (BSS identifier, BSSID) field, a high throughput capability field, a high throughput operation field, a 20 / 40BSS coexistence field, an overlapping BSS scan parameter field, an extended capability field, an intercommunication field, an extremely high throughput capability field, an extremely high throughput operation field, or an operation mode notification field. One or more of the fields.

[0010] Optionally, the AP receives a second operation class management frame sent by the STA, the frame body of the second operation class management frame includes a second encrypted field, and the second operation class management frame is a detection request frame, an authentication request frame, an association request frame, or a reassociation request frame. The AP uses a second key to decrypt the second encrypted field to obtain the content of the second encrypted field.

[0011] The second key is the same as the first key, or the second key is different from the first key.

[0012] The present application pre-sets a key in the AP so that the AP can use the preset key to decrypt the frame body of the second operation type management frame sent by the received STA, so as to realize the encrypted transmission of the management frame sent by the STA before the AP and the STA are successfully associated, thereby improving the security of WLAN communication.

[0013] Optionally, the second key is pre-stored in a non-volatile memory or a hardware encryption device of the AP.

[0014] In a second aspect, a management frame transmission method for a WLAN is provided. The method includes: a STA receives a first operation-type management frame sent by an AP, a frame body of the first operation-type management frame includes a first encrypted field, and the first operation-type management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame. The STA uses a first key to decrypt the first encrypted field to obtain the content of the first encrypted field.

[0015] The present application pre-sets a key in the STA so that the STA can use the preset key to decrypt the frame body of the first operation type management frame sent by the AP, so as to realize the encrypted transmission of the management frame sent by the AP before the AP and the STA are successfully associated, thereby improving the security of WLAN communication.

[0016] Optionally, the first key is pre-stored by a non-volatile memory or a hardware encryption device of the STA.

[0017] Optionally, the first operation class management frame is a beacon frame, and one or more of a timestamp field, a beacon interval field, a capability information field, a transmission indication mapping field, or a channel switching announcement field of the frame body of the beacon frame are outside the first encryption field.

[0018] Optionally, the first operation class management frame is a beacon frame, and the frame body of the first operation class management frame carries a first check value, which is calculated by the AP for a first field to be checked in the frame body of the first operation class management frame, and the first check value is used to perform integrity check on the first field to be checked, and the first field to be checked includes one or more of a supported rate and BSS member selection field, a direct sequence spread spectrum parameter set field, a power constraint field, a silence field, an extended rate physical layer field, an extended supported rate and BSS member selection field, a multiple BSSID field, a high throughput capability field, a high throughput operation field, a 20 / 40BSS coexistence field, an overlapping BSS scan parameter field, an extended capability field, an intercommunication field, an extremely high throughput capability field, an extremely high throughput operation field, or an operation mode notification field outside the first encryption field.

[0019] Optionally, the STA sends a second operation type management frame to the AP, the frame body of the second operation type management frame includes a second encryption field, the second encryption field is encrypted using a second key, and the second operation type management frame is a detection request frame, an authentication request frame, an association request frame, or a reassociation request frame.

[0020] The second key is the same as the first key, or the second key is different from the first key.

[0021] The present application pre-sets a key in the STA so that the STA can use the preset key to encrypt the frame body of the second operation type management frame issued, so as to realize the encrypted transmission of the management frame issued by the STA before the AP and the STA are successfully associated, thereby improving the security of WLAN communication.

[0022] Optionally, the second key is pre-stored by a non-volatile memory or a hardware encryption device of the STA.

[0023] In a third aspect, an AP is provided. The AP includes multiple functional modules, and the multiple functional modules interact with each other to implement the method in the first aspect and its respective embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on specific implementations.

[0024] In a fourth aspect, a STA is provided. The STA includes multiple functional modules, and the multiple functional modules interact with each other to implement the method in the second aspect and its respective embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on the specific implementation.

[0025] In a fifth aspect, a WLAN is provided, including: an AP and a STA, wherein the AP is used to implement the method in the above-mentioned first aspect and its respective embodiments, and the STA is used to implement the method in the above-mentioned second aspect and its respective embodiments.

[0026] In a sixth aspect, an AP is provided, comprising: a processor and a key storage device.

[0027] The key storage device is used to store a first key. The processor is used to execute the method in the first aspect and each embodiment thereof. For example, the processor is used to send a first operation class management frame, the frame body of the first operation class management frame includes a first encryption field, the first encryption field is encrypted by the first key stored in the key storage device, and the first operation class management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame.

[0028] In a seventh aspect, a STA is provided, comprising: a processor and a key storage device.

[0029] The key storage device is used to store a first key. The processor is used to execute the method in the above-mentioned second aspect and each embodiment thereof. For example, after receiving a first operation-type management frame sent by an AP and including a first encrypted field in the frame body, the processor is used to decrypt the first encrypted field using the first key stored in the key storage device to obtain the content of the first encrypted field, and the first operation-type management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame.

[0030] In an eighth aspect, a computer-readable storage medium is provided, on which instructions are stored. When the instructions are executed by a computer device, the method in the above-mentioned first aspect and its various embodiments or the method in the above-mentioned second aspect and its various embodiments is implemented.

[0031] In the ninth aspect, a chip is provided, which includes a programmable logic circuit and / or program instructions. When the chip is running, it implements the method in the above-mentioned first aspect and its various embodiments or the method in the above-mentioned second aspect and its various embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a schematic diagram of the structure of an operation management frame provided in an embodiment of the present application;

[0033] Figure 2 It is a schematic diagram of the structure of another operation management frame provided in an embodiment of the present application;

[0034] Figure 3 This is a schematic diagram of the structure of another operation management frame provided in an embodiment of the present application;

[0035] Figure 4 It is a structural diagram of a WLAN provided in an embodiment of the present application;

[0036] Figure 5 It is a flow chart of a management frame transmission method of a WLAN provided in an embodiment of the present application;

[0037] Figure 6 It is a flowchart of another WLAN management frame transmission method provided in an embodiment of the present application;

[0038] Figure 7 is a schematic diagram of the structure of an AP provided in an embodiment of the present application;

[0039] Figure 8 This is a schematic diagram of the structure of a STA provided in an embodiment of the present application;

[0040] Fig. 9 is a block diagram of an AP provided in an embodiment of the present application;

[0041] Fig.10 This is a block diagram of a STA provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0043] WLAN is a computer local area network that uses wireless channels as transmission media. WLAN includes AP and STA. AP is used to provide STA with wireless access services based on WLAN protocol. WLAN protocol defines the Institute of Electrical and Electronics Engineers (IEEE) 802.11 series standards.

[0044] Compared with wired networks, WLAN has inherent data security issues. All WLAN devices in a region share the transmission medium, and any WLAN device can receive data from all other WLAN devices. This feature directly threatens the security of WLAN access data. Therefore, the WLAN protocol defines the security standard IEEE802.11i, which involves user access control and identity authentication, user data encryption, key management and other aspects. However, the above security measures do not protect management frames, and management frames are still exposed to insecure network environments. Therefore, the WLAN protocol further defines a protection protocol IEEE 802.11w for management frames.

[0045] The IEEE 802.11w protocol is mainly based on the existing encryption form of data frames, and similarly encrypts management frames. The IEEE 802.11w protocol encrypts disassociation frames, deauthentication frames, and some action frames. However, in the management frame encryption method implemented based on the IEEE 802.11w protocol, it is necessary for the AP and STA to negotiate a key after the association is successful, and then use the negotiated key to encrypt the unicast management frames (such as disassociation frames or deauthentication frames) sent by the AP or STA. In other words, before the AP and STA negotiate a key, all management frames sent by the AP and STA cannot be encrypted and protected. The WLAN protocol only supports the AP and STA to negotiate a key after the association is successful. Therefore, based on the existing IEEE 802.11w protocol, it is impossible to encrypt and protect the management frames sent by the AP and STA before the association is successful.

[0046] Before the AP successfully associates with the STA, the management frames sent by the AP include beacon frames, probe response frames, authentication response frames, association response frames, and reassociation response frames, and the management frames sent by the STA include probe request frames, authentication request frames, association request frames, and reassociation request frames. In this application, the above management frames sent by the AP before the successful association with the STA are collectively referred to as operation class management frames. In order to facilitate the distinction and description, this application collectively refers to the above management frames sent by the AP as first operation class management frames, and the above management frames sent by the STA as second operation class management frames.

[0047] Since the AP and STA cannot negotiate the key before the association is successful, the above-mentioned operation management frames cannot be encrypted for transmission protection. Otherwise, the AP and STA will not be able to parse and respond to the received operation management frames normally, and the STA will be unable to associate with the AP. However, if the above-mentioned operation management frames are eavesdropped by attackers during transmission, network information will be leaked, affecting the communication security of the WLAN. For example, for beacon frames, if the beacon frames broadcast by the AP are eavesdropped by attackers, then the attackers will know the capabilities of the network. At this time, the attackers can induce the STA to connect by forging the same beacon frames, thereby obtaining the identity information and related data of the STA, causing the STA's information to be leaked, or the attackers can keep trying to connect to the AP, occupying a large amount of AP processing resources and air interface resources, thus causing normal STAs to be unable to communicate normally. For example, for association request frames and association response frames, the association request frame includes the STA's identity information and required service parameters, and the association response frame includes the AP's identity information, service parameters, and key information for establishing a secure connection (if the security mechanism is enabled). If the association request frame sent by the STA is eavesdropped by the attack frame, the attacker can collect the STA's identity information in the WLAN, causing the STA's information to be leaked. Similarly, if the association response frame sent by the AP is eavesdropped by the attacker, the attacker can collect the AP's identity information in the WLAN, causing the AP's information to be leaked.

[0048] The embodiment of the present application provides a technical solution, by presetting keys in AP and STA, so that AP can use the preset key to encrypt the frame body of the first operation-type management frame sent, and STA can use the preset key to decrypt the frame body of the first operation-type management frame received; and / or, so that STA can use the preset key to encrypt the frame body of the second operation-type management frame sent, and AP can use the preset key to decrypt the frame body of the second operation-type management frame received. Thereby, encrypted transmission of operation-type management frames between AP and STA is realized, thereby improving WLAN communication security. The embodiment of the present application constructs an encrypted dedicated WLAN, so that only AP (hereinafter referred to as authorized AP) and STA (hereinafter referred to as authorized STA) with mutually matching keys preset can decrypt the contents of the operation management frame sent by the other party, that is, unauthorized devices in the WLAN cannot parse and obtain the encrypted information of the operation-type management frame, and accordingly, unauthorized devices cannot access the dedicated WLAN, so it can also reduce private network data interference and improve data transmission stability.

[0049] Optionally, the keys preset in the AP are pre-stored by a key storage device, such as a non-volatile memory (non-volatile memory) or a hardware encryption device of the AP. The keys preset in the STA are pre-stored by a key storage device, such as a non-volatile memory or a hardware encryption device of the STA. Among them, the non-volatile memory includes but is not limited to a read-only memory (ROM), an electronic fuse (eFuse) (eFuse is a one-time programmable memory) or a flash memory. The hardware encryption device can be, for example, a universal serial bus (USB) key (USB key), a hardware security module (HSM) or other devices that can be used to store keys and have encryption functions. If the keys in the AP / STA are pre-stored by a non-volatile memory, the AP / STA can read the keys from the non-volatile memory through an internal processor, and encrypt and decrypt the operation management frame through the processor. If the key in the AP / STA is pre-stored by a hardware encryption device, the AP / STA can encrypt and decrypt the operation management frame through the hardware encryption device, or the AP / STA can read the key from the hardware encryption device through an internal processor and encrypt and decrypt the operation management frame.

[0050] Optionally, there are multiple ways to implement pre-setting keys in AP / STA. The key storage device can be built into the AP / STA, or the AP / STA can also be connected to an external key storage device. In the embodiment of the present application, the key storage device built into the AP / STA and the external key storage device connected to the AP / STA are collectively referred to as the key storage device of the AP / STA. For example, the AP / STA can preset the key in the key storage device built into the AP / STA before leaving the factory, that is, the manufacturer can provide a customized authorized AP / authorized STA. Alternatively, after the AP / STA is powered on, the key can be remotely downloaded from the key server based on the input password, and the downloaded key can be stored in the key storage device. Alternatively, the key is pre-stored in an external key storage device, and after the AP / STA is powered on, the external key storage device can be connected through a physical interface to obtain the key stored in the external key storage device. Optionally, the user can unlock the key stored in the key storage device through a secure operation, such as verifying a fingerprint, entering a personal identification number (PIN), operating through a microphone voice, inserting a USB key, or pressing a button. The embodiment of the present application does not limit the implementation method of pre-setting the key in the AP / STA.

[0051] In the embodiment of the present application, a private network can be pre-planned so that an AP that is planned to provide wireless access services in the private network and a STA that is planned to access the private network can obtain and pre-store matching keys.

[0052] Optionally, the key used by the AP and the STA is a symmetric key or an asymmetric key. One or more sets of keys may be pre-stored in the non-volatile memory or hardware encryption device of the AP and the STA. The AP and the STA may use the same key to encrypt different types of operation management frames, or may use different keys to encrypt different types of operation management frames. For example, the AP uses key 1 to encrypt the frame body of the beacon frame, and the STA uses key 2 to decrypt the frame body of the beacon frame; the STA uses key 3 to encrypt the frame body of the probe request frame, and the AP uses key 4 to decrypt the frame body of the probe request frame. Among them, key 1 and key 2 are symmetric keys, that is, key 1 and key 2 are the same. Alternatively, key 1 and key 2 are a pair of asymmetric keys, for example, key 1 and key 2 may be a public-private key pair of the AP or the STA, specifically, key 1 is the private key of the AP, and key 2 is the public key of the AP; or, key 1 is the public key of the STA, and key 2 is the private key of the STA. Similarly, key 3 and key 4 may be symmetric keys, or may be a pair of asymmetric keys. Optionally, key 3 is the same key as key 2, and key 4 is the same key as key 1, that is, the key used by AP to encrypt the frame body of the beacon frame is the same as the key used by AP to decrypt the frame body of the probe request frame, and the key used by STA to decrypt the frame body of the beacon frame is the same as the key used by STA to encrypt the frame body of the probe request frame. Alternatively, key 3 and key 2 are different keys pre-stored in STA, and key 4 and key 1 are different keys pre-stored in AP, that is, the key used by AP to encrypt the frame body of the beacon frame is different from the key used by AP to decrypt the frame body of the probe request frame, and the key used by STA to decrypt the frame body of the beacon frame is different from the key used by STA to encrypt the frame body of the probe request frame. For example, key 1 and key 2 are broadcast keys pre-stored in AP and STA, respectively, and are used to encrypt and decrypt broadcast management frames, and key 4 and key 3 are unicast keys pre-stored in AP and STA, respectively, and are used to encrypt and decrypt unicast management frames.

[0053] Optionally, the AP or STA may encrypt all or part of the fields of the frame body of the above-mentioned operation-type management frame. For example, for the AP, the AP may encrypt part of the fields of the frame body of the beacon frame, and may encrypt all the fields of the frame body of the probe response frame, the authentication response frame, the association response frame, and the reassociation response frame. For the STA, the STA may encrypt all the fields of the frame body of the probe request frame, the authentication request frame, the association request frame, and the reassociation request frame. Which fields in each type of operation-type management frame need to be encrypted and which fields do not need to be encrypted may be pre-configured in the AP and the STA.

[0054] Optionally, the frame body of the operation class management frame carries a check value, which is calculated by the device sending the operation class management frame for the field to be checked in the frame body of the operation class management frame, and the check value is used to perform integrity check on the field to be checked. Optionally, the field to be checked may be all fields or part of the field of the frame body of the operation class management frame. For example, the field to be checked in the frame body of the beacon frame may be part of the field in the frame body, and the field to be checked in the frame body of other management frames other than the beacon frame in the above-mentioned operation class management frame may be all fields in the frame body. The check value is, for example, a message integrity code (MIC), which can be carried in the management MIC information element (MMIE) field of the frame body. The calculation method of the check value and the integrity check method can refer to the relevant content in IEEE 802.11w, and the embodiments of the present application will not be repeated here. Which fields in each type of operation class management frame need to be checked for integrity and which fields do not need to be checked for integrity can be pre-configured in the AP and STA.

[0055] Optionally, the encrypted field in the frame body of the operation management frame includes a field to be checked, and / or the field to be encrypted in the frame body of the operation management frame includes an encrypted field. In other words, the frame body of the operation management frame may include one or more of fields that require encryption and integrity checking (i.e., encrypted and integrity protected fields), fields that require encryption but do not require integrity checking (i.e., encrypted but not integrity protected fields), and fields that do not require encryption but require integrity checking (non-encrypted but integrity protected fields). Optionally, the frame body of the operation management frame may also include fields that do not require encryption and integrity checking (i.e., non-encrypted and non-integrity protected fields). For example, Figure 1 Schematic diagram of the structure of an operation management frame provided by an embodiment of the present application. Figure 1 As shown, the operation management frame includes a medium access control (MAC) header, a frame body and a frame check sequence (FCS). The frame body may include a non-encrypted and non-integrity protection field, a non-encrypted and integrity protection field, an encrypted and non-integrity protection field, and an encrypted and integrity protection field. The arrangement order of the non-encrypted and integrity protection field, the encrypted and non-integrity protection field, and the encrypted and integrity protection field is not limited, and the arrangement order of the contents contained in these three types of fields is also not limited. The number of these three types of fields may also be more than one, for example, one or more encrypted and integrity protection fields may be followed by one or more encrypted and non-integrity protection fields, followed by one or more encrypted and integrity protection fields.

[0056] Optionally, all fields of the frame body of other management frames in the above-mentioned operation management frame except the beacon frame can be configured to require encryption and integrity verification. Figure 2 Schematic diagram of another operation management frame provided in an embodiment of the present application. Figure 2 As shown, the frame body of the operation class management frame only includes the encryption and integrity protection fields. Figure 2 The illustrated operation-type management frame may be, for example, a probe request frame, a probe response frame, an authentication request frame, an authentication response frame, an association request frame, an association response frame, a reassociation request frame, or a reassociation response frame.

[0057] Optionally, the frame body of the beacon frame may include a non-encrypted and non-integrity-protected field, a non-encrypted and integrity-protected field, and an encrypted and integrity-protected field. Figure 3 Schematic diagram of another operation management frame provided in the embodiment of the present application. Figure 3 As shown, the operation class management frame includes a non-encrypted and non-integrity protection field, a non-encrypted and integrity protection field, and an encrypted and integrity protection field. Figure 3 The operational class management frame shown may be a beacon frame.

[0058] Among them, the unencrypted and unintegrity-protected fields in the frame body of the beacon frame may include one or more of a timestamp field, a beacon interval field, a capability information field, a traffic indication map (TIM) field, or a channel switch announcement field. As defined in the WLAN protocol, the beacon frame must include a timestamp field, a beacon interval field, and a capability information field, and the positions of these three fields in the beacon frame are fixed, so these three fields may not be encrypted to avoid changing the structure of the beacon frame and affecting compatibility. The TIM field and the channel switch announcement field need to be filled in by the driver software in the AP before sending a packet, so the AP is usually unable to encrypt these two fields and calculate the check value before sending a packet. The unencrypted integrity-protected fields in the frame body of the beacon frame may include a supported rates and BSS membership selectors field, a direct sequence spread spectrum (DSSS) parameter set (DSSS parameter set) field, a power constraint field, a quiet field, an extended rate PHY (ERP) field, an extended supported rates and BSS membership selectors field, a multiple BSS identifier (multiple BSSID) field, a high throughput (HT) capability (HT capabilities) field, a high throughput operation (HT operation) field, a 20 / 40 BSS coexistence field, an overlapping BSS scan parameters field, an extended capabilities field, an interworking field, and a very high throughput (VHT) capability (VHT operation) field. The QoS capability field, the Very High Throughput Operation (VHToperation) field, or the Operating Mode Notification field may be one or more of the following:Considering that some STAs receive and process the above-mentioned unencrypted integrity-protected fields through transceivers, and decryption needs to be performed by the STA's processor, these fields may not be sent to the processor for decryption due to STA performance limitations. Therefore, the AP does not encrypt these fields to be compatible with more WLAN devices. The contents of the frame body of the beacon frame except the unencrypted integrity-protected field and the unencrypted integrity-protected field can be set in the encrypted integrity-protected field. Alternatively, the above-mentioned unencrypted integrity-protected field can also be set to an encrypted integrity-protected field, which is not limited in this embodiment of the present application.

[0059] The embodiments of the present application can be applied to various security demand scenarios and can restrict unauthorized devices from accessing the WLAN. For example, Figure 4 Schematic diagram of a WLAN structure provided by an embodiment of the present application. Figure 4 As shown, the WLAN includes AP 101 and STA 102. AP 101 is used to provide a bridging function between the WLAN and other types of networks (such as wired networks). The number of STAs and APs in the figure is only used as an exemplary illustration and is not intended to limit the WLAN provided in the embodiments of the present application.

[0060] STA 102 is configured with WLAN function. For example, STA 102 can be a smart phone, a laptop, an Internet of Things (IoT) device, an automated optical inspection (AOI) device or a smart wearable device with a WLAN chip. AP 101 is a network device that supports WLAN. For example, AP 101 can be a wireless router. AP 101 is used to provide STA 102 with wireless access services based on the WLAN protocol.

[0061] In the embodiment of the present application, the non-volatile memory or hardware encryption device of AP 101 and STA 102 both pre-store matching keys. AP 101 can use the pre-stored key to encrypt the sent operation class management frame, and STA 102 can use the pre-stored key to decrypt the operation class management frame from AP 101. Similarly, STA 102 can use the pre-stored key to encrypt the operation class management frame sent to AP 101, and AP 101 can use the pre-stored key to decrypt the operation class management frame from STA 102.

[0062] The management frame transmission method provided in the embodiment of the present application can be applied to Figure 4 For example, Figure 5 FIG. 1 is a flow chart of a WLAN management frame transmission method provided in an embodiment of the present application. Figure 5 As shown, the method includes but is not limited to the following steps 501 to 504. Among them, steps 501 to 502 show the implementation of the AP sending an operation management frame to the STA; steps 503 to 504 show the implementation of the STA sending an operation management frame to the AP. In the embodiment of the present application, steps 501 to 502 and steps 503 to 504 can be decoupled, that is, steps 501 to 502 can be performed separately, or steps 503 to 504 can be performed separately.

[0063] Step 501, AP sends a first operation type management frame, the frame body of the first operation type management frame includes a first encryption field, the first encryption field is encrypted by key 11, and the first operation type management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame or a reassociation response frame.

[0064] Optionally, the first operation management frame is a beacon frame, and the first encrypted field may be a partial field of the frame body of the beacon frame. The structure of the beacon frame may be, for example, referred to Figure 3 Alternatively, the first operation management frame is a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame, and the first encrypted field may be all fields of the frame body. The structures of the probe response frame, the authentication response frame, the association response frame, and the reassociation response frame may be, for example, referenced Figure 2 .

[0065] Optionally, the key 11 is pre-stored in a non-volatile memory or a hardware encryption device of the AP.

[0066] After receiving the first operation type management frame sent by the AP, the STA may perform the following step 502.

[0067] Step 502: STA uses key 12 to decrypt the first encrypted field to obtain the content of the first encrypted field.

[0068] Optionally, the key 12 is pre-stored in a non-volatile memory or a hardware encryption device of the STA, wherein the key 12 and the key 11 are symmetric keys or a pair of asymmetric keys.

[0069] In an embodiment of the present application, by presetting keys in the AP and the STA, the AP can use the preset keys to encrypt the frame body of the first operation type management frame it sends, and the STA can use the preset keys to decrypt the frame body of the received first operation type management frame, thereby realizing encrypted transmission of management frames sent by the AP before the AP and the STA are successfully associated, which can improve the security of WLAN communications.

[0070] Optionally, the frame body of the first operation class management frame carries a check value 11, which is calculated by the AP for the first field to be checked in the frame body of the first operation class management frame, and the check value 11 is used to perform integrity check on the first field to be checked. After receiving the first operation class management frame, the STA calculates a check value 12 for the first field to be checked in the frame body of the received first operation class management frame. If the check value 12 is the same as the check value 11, the STA determines that the first field to be checked passes the integrity check, that is, the STA can determine that the first field to be checked has not been tampered with during the transmission process, and further, the STA can respond to the first operation class management frame. On the contrary, if the check value 12 is different from the check value 11, the STA determines that the first field to be checked has not passed the integrity check, and at this time, the STA directly discards the first operation class management frame and does not respond to the first operation class management frame.

[0071] Optionally, the first operation-type management frame is a beacon frame, and the first field to be encrypted may be a partial field of the frame body of the beacon frame. The structure of the beacon frame may be, for example, referred to Figure 3 Alternatively, the first operation management frame is a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame, and the first field to be encrypted may be all fields of the frame body. The structures of the probe response frame, the authentication response frame, the association response frame, and the reassociation response frame may be, for example, referenced Figure 2 .

[0072] In an embodiment of the present application, by carrying the check value of the field to be checked in the first operation type management frame sent by the AP, the STA can perform an integrity check on the field to be checked in the received first operation type management frame to determine the message integrity (i.e., whether it has been tampered with), which can further improve the security and reliability of WLAN communication.

[0073] Step 503: The STA sends a second operation class management frame to the AP. The frame body of the second operation class management frame includes a second encryption field, the second encryption field is encrypted using key 21, and the second operation class management frame is a detection request frame, an authentication request frame, an association request frame, or a reassociation request frame.

[0074] Optionally, the second encrypted field is all fields of the frame body of the second operation class management frame. The structures of the detection request frame, the authentication request frame, the association request frame and the reassociation request frame can be referred to, for example. Figure 2 .

[0075] Optionally, the key 21 is pre-stored in a non-volatile memory or a hardware encryption device of the STA.

[0076] After the AP receives the second operation type management frame sent by the STA, the AP may perform the following step 503 .

[0077] Step 504: The AP uses the key 22 to decrypt the second encrypted field to obtain the content of the second encrypted field.

[0078] Optionally, the key 22 is pre-stored in a non-volatile memory or a hardware encryption device of the AP, wherein the key 22 and the key 21 are symmetric keys or a pair of asymmetric keys.

[0079] Optionally, the key 21 and the key 12 pre-stored in the STA may be the same key, or may be different keys. The key 11 and the key 22 pre-stored in the AP may be the same key, or may be different keys. In addition, if the key 11 used by the AP to encrypt data and the key 21 used by the STA to encrypt data are the same key, the key 12 used by the STA to decrypt data and the key 22 used by the AP to decrypt data may also be the same key.

[0080] For example, key 11 and key 12 are symmetric keys, and key 21 and key 22 are also symmetric keys. If key 11 and key 21 are the same key, then key 12 and key 22 are also the same key. In this case, key 11 and key 22 pre-stored in the AP are the same key, and key 12 and key 21 pre-stored in the STA are also the same key. If key 11 and key 21 are different keys, then key 12 and key 22 are also different keys. In this case, key 11 and key 22 pre-stored in the AP are different keys, and key 12 and key 21 pre-stored in the STA are also different keys.

[0081] For another example, key 11 and key 12 are a pair of asymmetric keys, and key 21 and key 22 are a pair of asymmetric keys. If key 11 and key 21 are the same key, then key 12 and key 22 are also the same key. In this case, key 11 and key 22 pre-stored in the AP are different keys, and key 12 and key 21 pre-stored in the STA are also different keys. If key 11 and key 21 are different keys, then key 12 and key 22 are also different keys. In this case, key 11 and key 22 pre-stored in the AP may be different keys or the same key. Similarly, key 12 and key 21 pre-stored in the STA may be different keys or the same key. For example, Key 11 and Key 12 are the public-private key pair of AP, Key 22 and Key 21 are also the public-private key pair of AP, AP uses the private key of AP for encryption and decryption, and STA uses the public key of AP for encryption and decryption, that is, Key 11 and Key 22 are the private key of AP, and Key 12 and Key 21 are the public key of AP. In this case, Key 11 and Key 22 pre-stored in AP are the same key (AP's private key), and Key 12 and Key 21 pre-stored in STA are the same key (AP's public key). For another example, Key 11 and Key 12 are the public-private key pair of the AP, Key 21 and Key 22 are the public-private key pair of the STA, the AP uses the AP's private key for encryption and uses the STA's public key for decryption, the STA uses the AP's public key for decryption and uses the STA's private key for encryption, that is, Key 11 is the AP's private key, Key 12 is the AP's public key, Key 21 is the STA's private key, and Key 22 is the STA's public key. In this case, the Key 11 and Key 22 pre-stored in the AP are different keys (the AP's private key and the STA's public key, respectively), and the Key 12 and Key 21 pre-stored in the STA are different keys (the AP's public key and the STA's private key, respectively).

[0082] In an embodiment of the present application, by presetting keys in the AP and the STA, the STA can use the preset keys to encrypt the frame body of the second operation type management frame it sends, and the AP can use the preset keys to decrypt the frame body of the received second operation type management frame, thereby realizing encrypted transmission of management frames sent by the STA before the AP and the STA are successfully associated, which can improve the security of WLAN communications.

[0083] Optionally, the frame body of the second operation class management frame carries a check value 21, which is calculated by the STA for the second field to be checked in the frame body of the second operation class management frame, and the check value 21 is used to perform integrity check on the second field to be checked. After receiving the second operation class management frame, the AP calculates a check value 22 for the second field to be checked in the frame body of the received second operation class management frame. If the check value 22 is the same as the check value 21, the AP determines that the second field to be checked passes the integrity check, that is, the AP can determine that the second field to be checked has not been tampered with during the transmission process, and further, the AP can respond to the second operation class management frame. On the contrary, if the check value 22 is different from the check value 21, the AP determines that the second field to be checked has not passed the integrity check, and at this time, the AP directly discards the second operation class management frame and does not respond to the second operation class management frame.

[0084] Optionally, the second to-be-encrypted field is all fields of the frame body of the second operation class management frame. The structures of the detection response frame, the authentication response frame, the association response frame and the reassociation response frame can be referred to, for example. Figure 2 .

[0085] In an embodiment of the present application, by carrying the check value of the field to be checked in the second operation type management frame sent by the STA, the AP can perform an integrity check on the field to be checked in the received second operation type management frame to determine the message integrity (i.e., whether it has been tampered with), which can further improve the security and reliability of WLAN communication.

[0086] The following embodiments of the present application illustrate the implementation process of the association process between AP and STA. For example, Figure 6 FIG. 1 is a flow chart of another WLAN management frame transmission method provided in an embodiment of the present application. Figure 6 As shown, the method includes the following steps 601 to 614.

[0087] Step 601, AP sends a beacon frame, the frame body of which includes an unencrypted and unintegrity-protected field 11, an unencrypted and integrity-protected field 12, and an encrypted and integrity-protected field 13. The unencrypted and integrity-protected field 12 and the encrypted and integrity-protected field 13 are encrypted by key A1, and the encrypted and integrity-protected field 13 carries a check value A.

[0088] The check value A is a check value calculated for the non-encrypted integrity protection field 12 and the encrypted integrity protection field 13. The AP may send the beacon frame in a broadcasting manner.

[0089] Step 602: STA uses key A2 to decrypt the encrypted and integrity protected field 13 in the frame body of the beacon frame, obtains the content of the encrypted and integrity protected field 13, and performs integrity check on the non-encrypted and integrity protected field 12 and the encrypted and integrity protected field 13 in the frame body of the beacon frame according to the check value A.

[0090] Among them, key A2 and key A1 are symmetric keys or a pair of asymmetric keys.

[0091] After determining that the integrity check of the non-encrypted integrity protection field 12 and the encrypted integrity protection field 13 in the frame body of the beacon frame passes, the STA continues to execute the following step 603.

[0092] Step 603: The STA sends a probe request frame to the AP. The frame body of the probe request frame includes an encrypted integrity protection field 2, which is encrypted by the key B1 and carries a check value B.

[0093] Step 604: The AP uses the key B2 to decrypt the encrypted and integrity protected field 2 in the frame body of the probe request frame to obtain the content of the encrypted and integrity protected field 2, and performs an integrity check on the encrypted and integrity protected field 2 according to the check value B.

[0094] Among them, the key B2 and the key B1 are symmetric keys or a pair of asymmetric keys.

[0095] After determining that the integrity check of the encrypted and integrity protected field 2 in the frame body of the probe request frame passes, the AP continues to execute the following step 605 .

[0096] Step 605: The AP sends a probe response frame to the STA. The frame body of the probe response frame includes an encrypted integrity protection field 3, which is encrypted by the key C1 and carries a check value C.

[0097] Step 606: STA uses key C2 to decrypt the encrypted and integrity protected field 3 in the frame body of the probe response frame to obtain the content of the encrypted and integrity protected field 3, and performs integrity check on the encrypted and integrity protected field 3 according to the check value C.

[0098] Among them, key C2 and key C1 are symmetric keys or a pair of asymmetric keys.

[0099] After determining that the integrity check of the encrypted and integrity protected field 3 in the frame body of the probe response frame passes, the STA continues to execute the following step 607 .

[0100] Step 607: STA sends an authentication request frame to AP. The frame body of the authentication request frame includes an encrypted integrity protection field 4, which is encrypted by key D1 and carries a check value D.

[0101] Step 608: The AP uses the key D2 to decrypt the encrypted and integrity protected field 4 in the frame body of the authentication request frame to obtain the content of the encrypted and integrity protected field 4, and performs an integrity check on the encrypted and integrity protected field 4 according to the check value D.

[0102] The key D2 and the key D1 are symmetric keys or a pair of asymmetric keys.

[0103] After determining that the integrity check of the encrypted and integrity protected field 4 in the frame body of the authentication request frame passes, the AP continues to execute the following step 609 .

[0104] Step 609: The AP sends an authentication response frame to the STA. The frame body of the authentication response frame includes an encrypted integrity protection field 5, which is encrypted by the key E1 and carries a check value E.

[0105] Step 610: STA uses key E2 to decrypt the encrypted and integrity protected field 5 in the frame body of the authentication response frame to obtain the content of the encrypted and integrity protected field 5, and performs integrity check on the encrypted and integrity protected field 5 according to the check value E.

[0106] Among them, the key E2 and the key E1 are symmetric keys or a pair of asymmetric keys.

[0107] After determining that the integrity check of the encrypted and integrity protected field 5 in the frame body of the authentication response frame passes, the STA continues to execute the following step 611.

[0108] Step 611: STA sends an association request frame to AP. The frame body of the association request frame includes an encrypted integrity protection field 6. The encrypted integrity protection field 6 is encrypted by key F1. The encrypted integrity protection field 6 carries a check value F.

[0109] Step 612: The AP uses the key F2 to decrypt the encrypted and integrity protected field 6 in the frame body of the association request frame to obtain the content of the encrypted and integrity protected field 6, and performs an integrity check on the encrypted and integrity protected field 6 according to the check value F.

[0110] Among them, the key B2 and the key B1 are symmetric keys or a pair of asymmetric keys.

[0111] After determining that the integrity check of the encrypted and integrity protected field 2 in the frame body of the probe request frame passes, the AP continues to execute the following step 613 .

[0112] Step 613: The AP sends an association response frame to the STA. The frame body of the association response frame includes an encrypted integrity protection field 7, which is encrypted by the key G1 and carries a check value G.

[0113] Step 614: STA uses key G2 to decrypt the encrypted and integrity protected field 7 in the frame body of the association response frame to obtain the content of the encrypted and integrity protected field 7, and performs integrity check on the encrypted and integrity protected field 7 according to the check value G.

[0114] Among them, the key G2 and the key G1 are symmetric keys or a pair of asymmetric keys.

[0115] After the AP determines that the integrity check of the encrypted and integrity protected field 2 in the frame body of the probe request frame passes, the STA is successfully associated with the AP.

[0116] The order of steps of the management frame transmission method of WLAN provided in the embodiment of the present application can be adjusted appropriately, and the steps can also be increased or decreased according to the situation. For example, when STA uses active scanning to discover AP, the above step 601 may not be executed. Any technician familiar with the technical field can easily think of a change within the technical scope disclosed in this application, and it should be covered by the protection scope of this application. For example, the encryption method provided in the embodiment of the present application can also be applied to the transmission of management messages in cellular networks. The embodiments of the present application will not be repeated here one by one.

[0117] Figure 7 Schematic diagram of the structure of an AP provided in an embodiment of the present application. Figure 7 As shown, AP 700 includes but is not limited to a generating module 701 and a sending module 702. Optionally, AP 700 further includes a receiving module 703 and a processing module 704.

[0118] The generating module 701 is used to generate a first operation type management frame, the frame body of the first operation type management frame includes a first encryption field, the first encryption field is encrypted by a first key, and the first operation type management frame is a beacon frame, a detection response frame, an authentication response frame, an association response frame or a reassociation response frame. The sending module 702 is used to send the first operation type management frame.

[0119] Optionally, the first key is pre-stored in a non-volatile memory or a hardware encryption device of the AP.

[0120] Optionally, the first operation class management frame is a beacon frame, and one or more of a timestamp field, a beacon interval field, a capability information field, a transmission indication mapping field, or a channel switching announcement field of the frame body of the beacon frame are outside the first encryption field.

[0121] Optionally, the first operation class management frame is a beacon frame, and the frame body of the first operation class management frame carries a first check value, which is calculated by the AP for a first field to be checked in the frame body of the first operation class management frame, and the first check value is used to perform integrity check on the first field to be checked, and the first field to be checked includes one or more of a supported rate and BSS member selection field, a direct sequence spread spectrum parameter set field, a power constraint field, a silence field, an extended rate physical layer field, an extended supported rate and BSS member selection field, a multiple BSSID field, a high throughput capability field, a high throughput operation field, a 20 / 40BSS coexistence field, an overlapping BSS scan parameter field, an extended capability field, an intercommunication field, an extremely high throughput capability field, an extremely high throughput operation field, or an operation mode notification field outside the first encryption field.

[0122] Optionally, the receiving module 703 is configured to receive a second operation class management frame sent by the STA, the frame body of the second operation class management frame includes a second encrypted field, and the second operation class management frame is a detection request frame, an authentication request frame, an association request frame, or a reassociation request frame. The processing module 704 is configured to decrypt the second encrypted field using a second key to obtain the content of the second encrypted field.

[0123] Optionally, the second key is pre-stored in a non-volatile memory or a hardware encryption device of the AP.

[0124] Figure 8 Schematic diagram of a STA structure provided by an embodiment of the present application. Figure 8 As shown, STA 800 includes but is not limited to a receiving module 801 and a processing module 802. Optionally, STA 800 further includes a sending module 803.

[0125] The receiving module 801 is used to receive a first operation type management frame sent by the AP, the frame body of the first operation type management frame includes a first encrypted field, and the first operation type management frame is a beacon frame, a detection response frame, an authentication response frame, an association response frame, or a reassociation response frame. The processing module 802 is used to decrypt the first encrypted field using a first key to obtain the content of the first encrypted field.

[0126] Optionally, the first key is pre-stored by a non-volatile memory or a hardware encryption device of the STA.

[0127] Optionally, the first operation class management frame is a beacon frame, and one or more of a timestamp field, a beacon interval field, a capability information field, a transmission indication mapping field, or a channel switching announcement field of the frame body of the beacon frame are outside the first encryption field.

[0128] Optionally, the first operation class management frame is a beacon frame, and the frame body of the first operation class management frame carries a first check value, which is calculated by the AP for a first field to be checked in the frame body of the first operation class management frame, and the first check value is used to perform integrity check on the first field to be checked, and the first field to be checked includes one or more of a supported rate and BSS member selection field, a direct sequence spread spectrum parameter set field, a power constraint field, a silence field, an extended rate physical layer field, an extended supported rate and BSS member selection field, a multiple BSSID field, a high throughput capability field, a high throughput operation field, a 20 / 40BSS coexistence field, an overlapping BSS scan parameter field, an extended capability field, an intercommunication field, an extremely high throughput capability field, an extremely high throughput operation field, or an operation mode notification field outside the first encryption field.

[0129] Optionally, the sending module 803 is used to send a second operation type management frame to the AP, the frame body of the second operation type management frame includes a second encryption field, the second encryption field is encrypted using a second key, and the second operation type management frame is a detection request frame, an authentication request frame, an association request frame or a reassociation request frame.

[0130] Optionally, the second key is pre-stored by a non-volatile memory or a hardware encryption device of the STA.

[0131] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0132] The embodiment of the present application provides an AP, including: a processor and a key storage device. The key storage device is used to store a first key. The processor is used to execute Figure 5 or Figure 6 The steps performed by the AP in the method shown. For example, the processor is used to send a first operation class management frame, the frame body of the first operation class management frame includes a first encryption field, the first encryption field is encrypted by a first key stored in a key storage device, and the first operation class management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame. The first encryption field can be encrypted by the key storage device using the stored first key, or the first encryption field can also be encrypted by the processor using the first key stored in the key storage device.

[0133] For example, Fig. 9 is a block diagram of an AP provided in an embodiment of the present application. Fig. 9 As shown, AP 900 includes: a processor 901, a key storage device 902 and a transceiver 903. The key storage device 902 is used to store a first key. The processor 901 is used to call a computer program and cooperate with the transceiver 903 to implement the following Figure 5 or Figure 6 The steps performed by the AP in the method shown.

[0134] Optionally, the AP 900 further includes a memory 904, a communication bus 905, and a communication interface 906. The communication bus 905 may include a path to transmit information between the above components.

[0135] The processor 901 may be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0136] The memory 904 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, an optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Blu-ray disc, etc.), a disk or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 904 may exist independently and be connected to the processor 901 via a communication bus 905. The memory 904 may also be integrated with the processor 901.

[0137] The memory 904 is used to store the program code for executing the solution of the present application, and the execution is controlled by the processor 901. The processor 901 is used to execute the program code stored in the memory 904. The program code may include one or more software modules. The one or more software modules may be Figure 7 The software modules provided in the illustrated embodiment.

[0138] The key storage device 902 may be a non-volatile memory or a hardware encryption device of the AP 900. For example, the key storage device 902 may be the memory 904 described above.

[0139] The communication interface 906 uses the transceiver 903 to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), WLAN, etc.

[0140] In a specific implementation, as an embodiment, the AP may include multiple processors. Each of these processors may be a single-core processor or a multi-core processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0141] The present application embodiment provides a STA, including: a processor and a key storage device. The key storage device is used to store a first key. The processor is used to execute Figure 5 or Figure 6 The steps performed by the STA in the method shown. For example, the processor is used to, after receiving a first operation class management frame sent by the AP, whose frame body includes a first encrypted field, decrypt the first encrypted field using a first key stored in a key storage device to obtain the content of the first encrypted field, and the first operation class management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame.

[0142] For example, Fig.10 is a block diagram of a STA provided in an embodiment of the present application. Fig.10 As shown, STA 1000 includes: a processor 1001, a key storage device 1002 and a transceiver 1003. The key storage device 1002 is used to store a first key. The processor 1001 is used to call a computer program and cooperate with the transceiver 1003 to implement the following Figure 5 or Figure 6 Steps performed by STA in the method shown.

[0143] Optionally, the STA 1000 further includes a memory 1004, a communication bus 1005, and a communication interface 1006. The communication bus 1005 may include a path to transmit information between the above components.

[0144] The processor 1001 may be a general-purpose CPU, an ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.

[0145] The memory 1004 may be a ROM or other type of static storage device capable of storing static information and instructions, a RAM or other type of dynamic storage device capable of storing information and instructions, or an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compact disc, a laser disc, an optical disk, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk or other magnetic storage device, or any other medium capable of carrying or storing a desired program code in the form of an instruction or data structure and capable of being accessed by a computer, but not limited thereto. The memory 1004 may be independent and connected to the processor 1001 via a communication bus 1005. The memory 1004 may also be integrated with the processor 1001.

[0146] The memory 1004 is used to store the program code for executing the solution of the present application, and the execution is controlled by the processor 1001. The processor 1001 is used to execute the program code stored in the memory 1004. The program code may include one or more software modules. The one or more software modules may be Figure 8 The software modules provided in the embodiments.

[0147] The key storage device 1002 may be a non-volatile memory or a hardware encryption device of the STA 1000. For example, the key storage device 1002 may be the memory 1004 described above.

[0148] The communication interface 1006 uses the transceiver 1003 to communicate with other devices or communication networks, such as Ethernet, RAN, WLAN, etc.

[0149] In a specific implementation, as an embodiment, a STA may include multiple processors. Each of these processors may be a single-core processor or a multi-core processor. The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0150] The embodiment of the present application also provides a wireless local area network, including: an AP and a STA, wherein the AP is used to perform the following steps: Figure 5 or Figure 6 In the method shown in FIG. 1 , the AP performs the steps, and the STA performs the steps as follows: Figure 5 or Figure 6 The steps performed by STA in the method shown.

[0151] The embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, and when the instructions are executed by a processor of the AP, the following is implemented: Figure 5 or Figure 6 or, when the instructions are executed by the processor of the STA, the following steps are implemented: Figure 5 or Figure 6 The steps performed by STA in the method shown.

[0152] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor of an AP, implements the following Figure 5 or Figure 6 The steps performed by the AP in the method shown in the figure; or, when the computer program is executed by the processor of the STA, the following is implemented Figure 5 or Figure 6 The steps performed by STA in the method shown.

[0153] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0154] In the embodiments of the present application, the terms “first”, “second” and “third” are used for descriptive purposes only and should not be understood as indicating or implying relative importance.

[0155] The term "and / or" in this application is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0156] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0157] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the concept and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A management frame transmission method for a wireless local area network WLAN, characterized in that: The method comprises: The access point AP sends a first operation type management frame, the frame body of the first operation type management frame includes a first encryption field, the first encryption field is encrypted by a first key, and the first operation type management frame is a beacon frame, a detection response frame, an authentication response frame, an association response frame or a reassociation response frame.

2. The method according to claim 1, characterized in that The first key is pre-stored in a non-volatile memory or a hardware encryption device of the AP.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: The AP receives a second operation class management frame sent by the station STA, where the frame body of the second operation class management frame includes a second encryption field, and the second operation class management frame is a detection request frame, an authentication request frame, an association request frame, or a reassociation request frame; The AP uses a second key to decrypt the second encrypted field to obtain content of the second encrypted field.

4. The method according to claim 3, characterized in that: The second key is pre-stored in a non-volatile memory or a hardware encryption device of the AP.

5. A management frame transmission method for a wireless local area network WLAN, characterized in that: The method comprises: The station STA receives a first operation class management frame sent by the access point AP, where the frame body of the first operation class management frame includes a first encryption field, and the first operation class management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame; The STA uses a first key to decrypt the first encrypted field to obtain content of the first encrypted field.

6. The method according to claim 5, characterized in that The first key is pre-stored in a non-volatile memory or a hardware encryption device of the STA.

7. The method according to claim 5 or 6, characterized in that: The method further comprises: The STA sends a second operation type management frame to the AP, the frame body of the second operation type management frame includes a second encryption field, the second encryption field is encrypted using a second key, and the second operation type management frame is a detection request frame, an authentication request frame, an association request frame, or a reassociation request frame.

8. The method according to claim 7, characterized in that The second key is pre-stored in a non-volatile memory or a hardware encryption device of the STA.

9. The method according to any one of claims 1 to 8, characterized in that: The first operation class management frame is a beacon frame, and one or more of a timestamp field, a beacon interval field, a capability information field, a transmission indication mapping field or a channel switching announcement field of the frame body of the beacon frame are outside the first encryption field.

10. The method according to any one of claims 1 to 9, characterized in that: The first operation class management frame is a beacon frame, and the frame body of the first operation class management frame carries a first check value, which is calculated by the AP for a first field to be checked in the frame body of the first operation class management frame, and the first check value is used to perform integrity check on the first field to be checked, and the first field to be checked includes one or more of a supported rate and basic service set BSS member selection field, a direct sequence spread spectrum parameter set field, a power constraint field, a silence field, an extended rate physical layer field, an extended supported rate and BSS member selection field, a multiple BSS identifier field, a high throughput capability field, a high throughput operation field, a 20 / 40BSS coexistence field, an overlapping BSS scan parameter field, an extended capability field, an intercommunication field, an extremely high throughput capability field, an extremely high throughput operation field, or an operation mode notification field.

11. An access point AP, characterized in that: The AP includes: A generating module, configured to generate a first operation class management frame, wherein the frame body of the first operation class management frame includes a first encryption field, the first encryption field is encrypted by a first key, and the first operation class management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame; A sending module is used to send the first operation type management frame.

12. The AP according to claim 11, characterized in that: The AP further includes: A receiving module, configured to receive a second operation class management frame sent by a station STA, wherein the frame body of the second operation class management frame includes a second encryption field, and the second operation class management frame is a detection request frame, an authentication request frame, an association request frame, or a reassociation request frame; The processing module is used to decrypt the second encrypted field by using a second key to obtain the content of the second encrypted field.

13. A station STA, characterized in that: The STA includes: A receiving module, configured to receive a first operation class management frame sent by an access point AP, wherein the frame body of the first operation class management frame includes a first encryption field, and the first operation class management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a reassociation response frame; The processing module is used to decrypt the first encrypted field by using a first key to obtain the content of the first encrypted field.

14. The STA according to claim 13, characterized in that: The STA also includes: A sending module is used to send a second operation type management frame to the AP, the frame body of the second operation type management frame includes a second encryption field, the second encryption field is encrypted using a second key, and the second operation type management frame is a detection request frame, an authentication request frame, an association request frame or a reassociation request frame.

15. A wireless local area network, characterized in that: include: An access point AP and a station STA, wherein the AP is used to execute the method according to any one of claims 1 to 4 and 9 to 10, and the STA is used to execute the method according to any one of claims 5 to 10.

16. An access point AP, characterized in that: include: a processor and a key storage device; The key storage device is used to store a first key; The processor is used to send a first operation type management frame, the frame body of the first operation type management frame includes a first encryption field, the first encryption field is encrypted by the first key stored in the key storage device, and the first operation type management frame is a beacon frame, a detection response frame, an authentication response frame, an association response frame or a re-association response frame.

17. A station STA, characterized in that: include: processor and key storage device; The key storage device is used to store a first key; The processor is used to, after receiving a first operation-type management frame sent by an access point AP and whose frame body includes a first encryption field, use the first key stored in the key storage device to decrypt the first encryption field to obtain the content of the first encryption field. The first operation-type management frame is a beacon frame, a probe response frame, an authentication response frame, an association response frame, or a re-association response frame.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed by a computer device, the method according to any one of claims 1 to 10 is implemented.

Images