A method for establishing secure multi-connections between a terminal and multiple access points

Abstract

The present invention provides a method for establishing secure multi-connections between a terminal and multiple access points, and relates to the field of communication technology. The present invention establishes a communication method between a network access point AP, a multi-link terminal STA MLD and a terminal entity STA, so that the multi-link terminal is not limited to connecting to a multi-link access device, but can also connect to multiple single-link access devices, or a single-link access device can be connected to a multi-link access device, thereby expanding the application scenarios of the multi-link terminal and improving the efficiency of the multi-link terminal in using network resources. It solves the problem that the prior art must be connected to an access device that also supports multi-link, and that multiple links can only be established on the same access device for data transmission.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method for establishing secure multi-connections between a terminal and multiple access points. Background Art

[0002] 802.11be system, also known as Extremely High Throughput (EHT) system, is enhanced through a series of system features and multiple mechanisms to achieve extremely high throughput. As the use of wireless local area networks (WLAN) continues to grow, it is increasingly important to provide wireless data services in many environments such as homes, enterprises and hotspots. In particular, video traffic will continue to be the main type of traffic in many WLAN deployments. Due to the emergence of 4k and 8k video (uncompressed rate of 20Gbps), the throughput requirements of these applications are constantly evolving. New high-throughput, low-latency applications such as virtual reality or augmented reality, video transmission, remote control and cloud computing will proliferate (for example, the latency of remote control is less than 5 milliseconds).

[0003] Given the high throughput and stringent real-time latency requirements of these applications, users expect higher throughput, higher reliability, less latency, and higher power efficiency when supporting their applications through WLAN. The 802.11be system is designed to ensure the competitiveness of WLAN by further improving the total throughput and reducing latency, while ensuring backward compatibility and coexistence with older technical standards. 802.11-compatible devices operating in the 2.4GHz, 5GHz, and 6GHz frequency bands. In the 802.11be system, multi-link terminals are introduced, enabling the terminal to have the ability to send and receive data on multiple links at the same time. Since multiple logical entities can be set up inside a terminal, each logical entity can send and receive data independently.

[0004] However, when an existing multi-link terminal uses multi-link for operation, it must be connected to an access device that also supports multi-link, and multiple links can only be established on the same access device for data transmission.

[0005] Therefore, it is necessary to provide a method for a terminal to establish secure multiple connections with multiple access points to solve one of the above technical problems. Summary of the invention

[0006] In order to solve one of the above technical problems, the present invention proposes a method for establishing secure multi-connections between a terminal and multiple access points, which is used in an EHT system, including several network access points AP, multi-link terminals STA MLD and terminal entities STA, and multiple connections between the multi-link terminal STA MLD and multiple network access points AP are established through the following steps:

[0007] Multi-connection operation preparation steps:

[0008] The S1 multi-link terminal STA MLD receives the Beacon message and / or Proberesponse message broadcasted by each network access point AP; wherein the message content records the Multi connectivity capability information element;

[0009] The S2 multi-link terminal STA MLD obtains whether each network access point AP supports multi-connection operation through the Multi connectivity capability information element;

[0010] S3 establishes a list of network access points (APs) that support multi-connection operations and calls them when performing multi-connection operations;

[0011] Multi-connection operation execution steps:

[0012] The S4 multi-link terminal STA MLD evaluates each network access point AP in the network access point AP list according to the set selection strategy;

[0013] S5 ranks each network access point AP according to the evaluation, and obtains AP1 with the strongest evaluation and AP2 with the second strongest evaluation; AP1 is used as the primary network access point P-AP, and AP2 is used as the primary network access point S-AP;

[0014] S6 The multi-link terminal STA MLD sends an Association request message to AP1 through the terminal entity STA to request to establish a connection; wherein the Association request message includes a Multi connection element parameter;

[0015] S7 AP1 receives the Association request message and checks whether it meets the Multi connection element parameter and whether it supports the multi-connection operation mode; if both are met, it sends an S-AP addition request message to AP2 and generates a security key GTK; otherwise, AP1 cannot perform the multi-connection operation;

[0016] S8 After receiving the S-AP addition request message, if AP2 agrees to the request, it authenticates the multi-link terminal STAMLD, sets the parameter status code value to success, and sends an S-AP addition response message to AP1; if it disagrees to the request, it sets the parameter status code value to fail, and sends an S-AP addition response message to AP1;

[0017] S9 After receiving the S-AP addition response message, AP1 determines whether AP2 agrees to the request;

[0018] S10 If the status code value in the S-AP addition response message is success, AP1 adds the Multi connection element parameter in the Association response message and sends an Association response message to the STA MLD;

[0019] S11 If the status code value in the S-AP addition response message is fail, AP1 does not add the Multi connection element parameter in the Association response message and sends an Association response message to the STA MLD;

[0020] S11 After the multi-link terminal STA MLD receives the Association response message, if the message contains the Multi connection element parameter, it generates the security encryption information parameter STA Security info according to the Multi connection element parameter; and sends the Association request message to the access point (AP2) indicated by the S-AP address according to the S-AP address (AP2);

[0021] S12 After receiving the Association request message, AP2 determines that the STA corresponding to the information is the terminal entity STA that needs to perform multi-connection operation according to the STA address information and STA Security info in the message or the STA information obtained from the S-AP addition request received from AP1;

[0022] S13 AP2 generates a security key GTK according to the STA Security info information of the terminal entity STA that needs to perform multi-connection operations;

[0023] S14 AP2 sends an Association response message to the multi-link terminal STA MLD, which includes the security key GTK;

[0024] S15 The multi-link terminal STA MLD uses the received security key GTK to encrypt and decrypt the data of the multiple connections; AP1 and AP2 encrypt and decrypt the data of the multiple connection operation of the multi-link terminal STA MLD according to the security key GTK.

[0025] As a further solution, the selection strategy includes an RSSI selection strategy based on received signal strength sorting and an adjacent AP selection strategy based on adjacent AP information.

[0026] As a further solution, the Multi connection element parameter is used to describe the setting of the multi-link terminal STA MLD requesting to establish multiple connections;

[0027] In step S6 to step S7, it includes an S-AP Address parameter for describing the S-AP address, a STA MC mode parameter for describing the request for the multi-connection mode; an S-AP maximum bit rate parameter for describing the upper limit of the transmission rate between the terminal entity STA and the S-AP in the multi-connection mode; an S-AP TID parameter for describing the service identifier supported by the terminal entity STA on the S-AP in the multi-connection; and an STA Authentication info parameter for describing the authentication information of the STA, wherein the STA MC mode parameter is set to Split: indicating that the data separation mode is used, that is, data is sent or received on two APs at the same time; and the STA MC mode parameter is set to Switch: indicating that the data exchange mode is used, that is, data is sent or received on two APs alternately in segments;

[0028] In step S10 to step S11, it includes a Status code parameter for describing the response message result; a Dialog token parameter for identifying the current session; a STA MC mode parameter for describing the request for multi-connection mode; a UL split threshold parameter that exists when the STA MCmode parameter is split and is used to indicate the threshold value for uplink data separation; an S-AP Address parameter for describing the S-AP address; a STA S-AP maximum bit rate parameter for confirming the upper limit of the transmission rate of the S-AP in a multi-connection operation; and an S-AP Authentication info parameter for the authentication information of the S-AP.

[0029] As a further solution, the STA Authentication info parameters include the SNonce parameter for recording the random number generated by the terminal entity STA; the R0KH-ID parameter for recording the PMK-R0 management entity identifier (first level of the pairwise master key); and the PMKR0Name parameter for recording the first level name of the pairwise master key.

[0030] As a further solution, the S-AP addition request message is used to request AP2 as a primary network access point S-AP, including a Dialog token parameter for identifying the current session; a STA ID parameter for identifying a multi-link terminal STA MLD requesting to use multi-connection operation; an AP MCmode parameter for describing the mode of requesting multiple connections; a STA S-APmaximum bit rate parameter for describing the maximum transmission rate of the terminal entity STA requested on the S-AP in multiple connections; a STA S-AP TID parameter for describing the type of data service requested to be transmitted by the terminal entity STA on the S-AP in multiple connections; a STA Authentication info parameter for describing the authentication information of the terminal entity STA; wherein the AP MC mode parameter is set to MC over P-AP: indicating that the data of the S-AP and P-AP are aggregated or distributed at the P-AP; the AP MC mode parameter is set to MC over DS: indicating that the data of the S-AP and P-AP are aggregated or distributed at the DS server; the STA Authentication info parameter is consistent with the Association request message received by AP1 in step S6.

[0031] As a further solution, if the STA MC mode parameter requested by the multi-link terminal STA MLD in the Association request is set to split, AP1 sets the AP MC mode parameter to MC over P-AP; if the STA MC mode parameter requested by the multi-link terminal STA MLD in the Association request is set to switch, AP1 sets the APMC mode parameter to MC over DS.

[0032] As a further solution, when the status code value is success, the S-AP additionresponse message includes a Status code parameter for describing the result of the response message; a Dialog token parameter for identifying the current session; an AP MC mode parameter for confirming the multi-connection mode; a STA ID parameter for identifying the terminal entity STA; a STA S-AP maximum bitrate parameter for recording the upper limit of the transmission rate confirmed by the S-AP in the multi-connection operation; a STA S-AP TID parameter for recording the service identification supported by the S-AP in the multi-connection operation; and a S-AP Authentication info parameter for recording S-AP authentication information; wherein the Dialog token parameter is set to the value of the Dialog token parameter in the received S-AP addition request message; and the S-AP Authentication The info parameter is set to include the SNonce parameter used to record the random number generated by the terminal entity STA; the ANonce parameter used to record the random number generated by the S-AP; the R0KH-ID parameter used to record the PMK-R0 management entity identifier (first level of the pairwise master key); the R1KH-ID parameter used to record the PMK-R1 management entity identifier (second level of the pairwise master key); and the PMKR0Name parameter used to record the first level name of the pairwise master key;

[0033] When the status code value is fail; the S-AP addition response message includes a Status code parameter for describing the result of the response message; a Dialog token parameter for identifying the current session; a Cause value parameter for setting the reason for not agreeing to the request, and the Cause value parameter includes TID not supported: all requested TIDs are not supported; MAP not enabled: multi-connection operation is not enabled; BitRate not supported: the maximum transmission rate requested is not supported; Authentication failed: authentication failed.

[0034] In step S12, the STA Security info parameters include the SNonce parameter for recording the random number generated by the terminal entity STA; the ANonce parameter for recording the random number generated by the S-AP; the R0KH-ID parameter for recording the PMK-R0 management entity identifier (first level of the pairwise master key); the R1KH-ID parameter for recording the PMK-R1 management entity identifier (second level of the pairwise master key); and the PMKR1Name parameter for recording the second level name of the pairwise master key.

[0035] As a further solution, if the STA MC mode parameter in the Associationresponse message received by the multi-link terminal STA MLD from AP1 is split, when the size of the uplink data to be sent is greater than or equal to the value of the parameter ULsplit threshold parameter, the uplink data to be sent is divided among the terminal entities STA and sent to AP1 and AP2 at the same time;

[0036] If the STA MC mode parameter value in the Association response message received by the multi-link terminal STA MLD from AP1 is switch, adjustment is made according to the local policy, wherein the local policy includes sending data to AP2 when the signal strength / signal quality of AP1 is poor; and sending data to AP2 when the load of AP1 is heavy.

[0037] As a further solution, if the APMC mode parameter value in the S-AP addition response message sent by AP2 to AP is MC over P-AP, the received multi-link terminal STA MLD data is sent to AP1;

[0038] If the AP MC mode parameter value in the S-AP addition response message sent by AP2 to AP is MC overDS, the received multi-link terminal STA MLD data is directly sent to the DS server.

[0039] As a further solution, the security key GTK generated in step S7 is added to the Association response message in step S10, and steps S11 to S14 are skipped.

[0040] Compared with the related art, the method for establishing secure multi-connections between a terminal and multiple access points provided by the present invention has the following beneficial effects:

[0041] The present invention provides an architecture and a data transmission method for connecting a multi-link terminal to multiple access devices, so that the multi-link terminal is not limited to connecting to the multi-link access device, but can also connect to multiple single-link access devices, or a single-link access device can be connected to a multi-link access device, thereby expanding the application scenarios of the multi-link terminal and improving the efficiency of the multi-link terminal in using network resources. The problem that the prior art must be connected to an access device that also supports multi-link and can only establish multiple links on the same access device for data transmission is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A flowchart of a preferred embodiment of a method for establishing secure multiple connections between a terminal and multiple access points provided by the present invention;

[0043] Figure 2 A schematic diagram of an EHT system of a preferred embodiment of a method for establishing secure multiple connections between a terminal and multiple access points provided by the present invention. DETAILED DESCRIPTION

[0044] The present invention will be further described below in conjunction with the accompanying drawings and implementation modes.

[0045] like Figure 1 As shown, a method for establishing secure multi-connections between a terminal and multiple access points provided by the present invention is applied in an EHT system, and includes several network access points AP, multi-link terminals STA MLD and terminal entities STA.

[0046] This embodiment aims to provide a method for establishing secure multiple connections between a terminal and multiple access points. The establishment of secure multiple connections between multiple access points can be regarded as a plurality of access points connected in pairs. Therefore, this embodiment takes two network access points AP as an example, namely AP1 and AP2, and establishes multiple connections between a multi-link terminal STA MLD and multiple network access points AP through the following steps:

[0047] Multi-connection operation preparation steps:

[0048] The S1 multi-link terminal STA MLD receives the Beacon message and / or Proberesponse message broadcasted by each network access point AP; wherein the message content records the Multi connectivity capability information element; the information element is set as follows:

[0049]

[0050] The S2 multi-link terminal STA MLD obtains whether each network access point AP supports multi-connection operation through the Multi connectivity capability information element;

[0051] S3 establishes a list of network access points (APs) that support multi-connection operations and calls them when performing multi-connection operations;

[0052] Multi-connection operation execution steps:

[0053] The S4 multi-link terminal STA MLD evaluates each network access point AP in the network access point AP list according to the set selection strategy;

[0054] S5 ranks each network access point AP according to the evaluation, and obtains AP1 with the strongest evaluation and AP2 with the second strongest evaluation; AP1 is used as the primary network access point P-AP, and AP2 is used as the primary network access point S-AP;

[0055] S6 The multi-link terminal STA MLD sends an Association request message to AP1 through the terminal entity STA to request to establish a connection; wherein the Association request message includes a Multi connection element parameter;

[0056] S7 AP1 receives the Association request message and checks whether it meets the Multi connection element parameter and whether it supports the multi-connection operation mode; if both are met, it sends an S-AP addition request message to AP2 and generates a security key GTK; otherwise, AP1 cannot perform the multi-connection operation;

[0057] S8 After receiving the S-AP addition request message, if AP2 agrees to the request, it authenticates the multi-link terminal STAMLD, sets the parameter status code value to success, and sends an S-AP addition response message to AP1; if it disagrees to the request, it sets the parameter status code value to fail, and sends an S-AP addition response message to AP1;

[0058] S9 After receiving the S-AP addition response message, AP1 determines whether AP2 agrees to the request;

[0059] S10 If the status code value in the S-AP addition response message is success, AP1 adds the Multi connection element parameter in the Association response message and sends an Association response message to the STA MLD;

[0060] S11 If the status code value in the S-AP addition response message is fail, AP1 does not add the Multi connection element parameter in the Association response message and sends an Association response message to the STA MLD;

[0061] S11 After the multi-link terminal STA MLD receives the Association response message, if the message contains the Multi connection element parameter, it generates the security encryption information parameter STA Security info according to the Multi connection element parameter; and sends the Association request message to the access point (AP2) indicated by the S-AP address according to the S-AP address (AP2);

[0062] S12 After receiving the Association request message, AP2 determines that the STA corresponding to the information is the terminal entity STA that needs to perform multi-connection operation according to the STA address information and STA Security info in the message or the STA information obtained from the S-AP addition request received from AP1;

[0063] S13 AP2 generates a security key GTK according to the STA Security info information of the terminal entity STA that needs to perform multi-connection operations;

[0064] S14 AP2 sends an Association response message to the multi-link terminal STA MLD, which includes the security key GTK;

[0065] S15 The multi-link terminal STA MLD uses the received security key GTK to encrypt and decrypt the data of the multiple connections; AP1 and AP2 encrypt and decrypt the data of the multiple connection operation of the multi-link terminal STA MLD according to the security key GTK.

[0066] Therefore, the STA MLD can use only one set of keys to perform data transmission with two APs simultaneously in the multi-connection operation.

[0067] It should be noted that: P-AP in this embodiment is the abbreviation of Primary AP; S-AP is the abbreviation of Secondary AP; AP is the abbreviation of Access Point; Figure 2 As shown, here the SME (station management entity) is responsible for the information management of the equipment, and controls and manages the MAC layer by interacting with the MAC sublayer management entity, referred to as MLME, and controls and manages the PHY layer by interacting with the PHY Mangement Entity; the MAC layer includes the MLD upper MAC sublayer and the MLD lower MAC sublayer, wherein the functions of the MLD upper MAC sublayer include: 1. Authentication and connection; 2. Security key generation; 3. Frame sequence number allocation; 4. Frame encryption and decryption; 5. Data packet recording and reordering; 6. Selection of the L-MAC module for sending data and information interaction with the L-MAC; the functions of the MLD lower MAC sublayer include: 1. Link-level management information interaction and indication, such as beacon messages; 2. Link-level control information interaction and indication, such as RTS frames and CTS frames.

[0068] As a further solution, the selection strategies include an RSSI selection strategy based on received signal strength sorting and an adjacent AP selection strategy based on adjacent AP information.

[0069] As a further solution, the Multi connection element parameter is used to describe the settings of the multi-link terminal STA MLD requesting to establish multiple connections;

[0070] In step S6 to step S7, it includes an S-AP Address parameter for describing the S-AP address, a STA MC mode parameter for describing the request for the multi-connection mode; an S-AP maximum bit rate parameter for describing the upper limit of the transmission rate between the terminal entity STA and the S-AP in the multi-connection mode; an S-AP TID parameter for describing the service identifier supported by the terminal entity STA on the S-AP in the multi-connection; and an STA Authentication info parameter for describing the authentication information of the STA, wherein the STA MC mode parameter is set to Split: indicating that the data separation mode is used, that is, data is sent or received on two APs at the same time; and the STA MC mode parameter is set to Switch: indicating that the data exchange mode is used, that is, data is sent or received on two APs alternately in segments;

[0071] In step S10 to step S11, it includes a Status code parameter for describing the response message result; a Dialog token parameter for identifying the current session; a STA MC mode parameter for describing the request for multi-connection mode; a UL split threshold parameter that exists when the STA MCmode parameter is split and is used to indicate the threshold value for uplink data separation; an S-AP Address parameter for describing the S-AP address; a STA S-AP maximum bit rate parameter for confirming the upper limit of the transmission rate of the S-AP in a multi-connection operation; and an S-AP Authentication info parameter for the authentication information of the S-AP.

[0072] It should be noted that: STA MLD sends an association request message to AP1 through the logical entity STA1 to request to establish a connection. The message contains a Multi connection element parameter, which is used to indicate that STA MLD requests to establish multiple connections. The Multi connection element parameter is set to:

[0073]

[0074] The parameter STA Authentication info is set to include the following parameters:

[0075]

[0076]

[0077] As a further solution, the STA Authentication info parameters include the SNonce parameter used to record the random number generated by the terminal entity STA; the R0KH-ID parameter used to record the PMK-R0 management entity identifier (first level of the pairwise master key); and the PMKR0Name parameter used to record the first level name of the pairwise master key.

[0078] As a further solution, the S-AP addition request message is used to request AP2 to serve as the primary network access point S-AP, including a Dialog token parameter for identifying the current session; a STA ID parameter for identifying the multi-link terminal STA MLD requesting to use multi-connection operation; an AP MC mode parameter for describing the mode of requesting multiple connections; a STA S-AP maximumbit rate parameter for describing the maximum transmission rate requested for the terminal entity STA on the S-AP in multiple connections; a STAS-AP TID parameter for describing the data service type requested for the terminal entity STA to transmit on the S-AP in multiple connections; a STA Authentication info parameter for describing the authentication information of the terminal entity STA; wherein the AP MCmode parameter is set to MC over P-AP: indicating that the data of the S-AP and P-AP are aggregated or distributed at the P-AP; the AP MCmode parameter is set to MC over DS: indicating that the data of the S-AP and P-AP are aggregated or distributed at the DS server; the STAAuthentication info parameter is consistent with the Association request message received by AP1 in step S6.

[0079] As a further solution, if the STA MC mode parameter requested by the multi-link terminal STA MLD in the Association request is set to split, AP1 sets the AP MC mode parameter to MC over P-AP; if the STA MC mode parameter requested by the multi-link terminal STA MLD in the Association request is set to switch, AP1 sets the APMC mode parameter to MC over DS.

[0080] As a further solution, when the status code value is success, the S-AP addition response message includes a Status code parameter for describing the result of the response message; a Dialog token parameter for identifying the current session; an AP MC mode parameter for confirming the multi-connection mode; a STA ID parameter for identifying the terminal entity STA; a STA S-AP maximum bitrate parameter for recording the upper limit of the transmission rate confirmed by the S-AP in the multi-connection operation; a STA S-AP TID parameter for recording the service identification supported by the S-AP in the multi-connection operation; and a S-AP Authentication info parameter for recording the S-AP authentication information; wherein the Dialog token parameter is set to the value of the Dialog token parameter in the received S-AP addition request message; and the S-AP Authentication The info parameter is set to include the SNonce parameter used to record the random number generated by the terminal entity STA; the ANonce parameter used to record the random number generated by the S-AP; the R0KH-ID parameter used to record the PMK-R0 management entity identifier (first level of the pairwise master key); the R1KH-ID parameter used to record the PMK-R1 management entity identifier (second level of the pairwise master key); and the PMKR0Name parameter used to record the first level name of the pairwise master key;

[0081] When the status code value is fail, the S-AP addition response message includes a Status code parameter for describing the result of the response message; a Dialog token parameter for identifying the current session; and a Cause value parameter for setting the reason for not approving the request. The Cause value parameter includes TID not supported: all requested TIDs are not supported; MAP not enabled: multi-connection operation is not enabled; BitRate not supported: the requested maximum transmission rate is not supported; and Authentication failed: authentication failed.

[0082] In step S12, the STA Security info parameters include the SNonce parameter for recording the random number generated by the terminal entity STA; the ANonce parameter for recording the random number generated by the S-AP; the R0KH-ID parameter for recording the PMK-R0 management entity identifier (first level of the pairwise master key); the R1KH-ID parameter for recording the PMK-R1 management entity identifier (second level of the pairwise master key); and the PMKR1Name parameter for recording the second level name of the pairwise master key.

[0083] It should be noted that: after receiving the S-AP addition request message, if AP2 agrees to the request and passes the STA MLD authentication according to the STA Authentication info parameter, it sets the parameter status code value to success and sends an S-AP addition response message to AP1. The message is set to:

[0084]

[0085]

[0086] The parameter S-AP Authentication info is set to include the following parameters:

[0087]

[0088] After receiving the S-AP addition response message, if the status code value in the message is success, AP1 includes the Multi connection element parameter in the Association response message and sends an Association response message to the STA MLD;

[0089] The Multi connection element parameter is used to instruct the STA MLD to request the establishment of multiple connections. The parameter settings are:

[0090]

[0091]

[0092] After receiving the Association response message, if the message contains the Multiconnection element parameter, the STA MLD generates the security encryption information parameter STASecurity info according to the S-AP Authentication info, which contains the following information:

[0093]

[0094] As a further solution, if the STA MC mode parameter in the Associationresponse message received by the multi-link terminal STA MLD from AP1 is split, when the size of the uplink data to be sent is greater than or equal to the value of the parameter ULsplit threshold parameter, the uplink data to be sent is divided among the terminal entities STA and sent to AP1 and AP2 at the same time;

[0095] If the STA MC mode parameter value in the Association response message received by the multi-link terminal STA MLD from AP1 is switch, adjustment is made according to the local policy, wherein the local policy includes sending data to AP2 when the signal strength / signal quality of AP1 is poor; and sending data to AP2 when the load of AP1 is heavy.

[0096] As a further solution, if the APMC mode parameter value in the S-AP addition response message sent by AP2 to AP is MC over P-AP, the received multi-link terminal STA MLD data is sent to AP1;

[0097] If the AP MC mode parameter value in the S-AP addition response message sent by AP2 to AP is MC overDS, the received multi-link terminal STA MLD data is directly sent to the DS server.

[0098] As a further solution, the security key GTK generated in step S7 is added to the Association response message in step S10, and steps S11 to S14 are skipped.

[0099] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for establishing secure multi-connections between a terminal and multiple access points, used in an EHT system, characterized in that: It includes several network access points AP, multi-link terminals STA MLD and terminal entities STA, and establishes multiple connections between the multi-link terminal STA MLD and multiple network access points AP through the following steps: Multi-connection operation preparation steps: S1 A multi-link terminal STA MLD receives a Beacon message and / or a Probe response message broadcasted by each network access point AP; wherein the message content contains a Multi connectivity capability information element; S2 The multi-link terminal STA MLD obtains whether each network access point AP supports multi-connection operation through the Multi connectivity capability information element; S3 establishes a list of network access points APs that support multi-connection operations and calls them when performing multi-connection operations; Multi-connection operation execution steps: S4 The multi-link terminal STA MLD evaluates each network access point AP in the network access point AP list according to the set selection strategy; S5 ranks each network access point AP according to the evaluation, and obtains AP1 with the strongest evaluation and AP2 with the second strongest evaluation; AP1 is used as the primary network access point P-AP, and AP2 is used as the primary network access point S-AP; S6 The multi-link terminal STA MLD sends an Association request message to AP1 through the terminal entity STA to request to establish a connection; wherein the Association request message includes a Multi connection element parameter; S7 AP1 receives the Association request message and checks whether it meets the Multi connection element parameter and whether it supports the multi-connection operation mode; if both are met, it sends an S-AP addition request message to AP2 and generates a security key GTK; otherwise, AP1 cannot perform the multi-connection operation; S8 After receiving the S-AP addition request message, if AP2 agrees to the request, it authenticates the multi-link terminal STA MLD, sets the parameter status code value to success, and sends an S-AP addition response message to AP1; if it disagrees to the request, it sets the parameter status code value to fail, and sends an S-AP addition response message to AP1; S9 After receiving the S-AP addition response message, AP1 determines whether AP2 agrees to the request; S10 If the status code value in the S-AP addition response message is success, AP1 adds the Multi connection element parameter in the Association response message and sends an Association response message to the STA MLD; S11 If the status code value in the S-AP addition response message is fail, AP1 does not add the Multi connection element parameter in the Association response message and sends an Association response message to the STA MLD; S11 After receiving the Association response message, if the message contains the Multiconnection element parameter, the multi-link terminal STA MLD generates the security encryption information parameter STA Security info according to the Multi connection element parameter; and sends the Association request message to the access point indicated by the S-AP address according to the S-AP address; S12 After receiving the Association request message, AP2 determines that the STA corresponding to the information is the terminal entity STA that needs to perform multi-connection operation according to the STA address information and STASecurity info in the message or the STA information obtained from the S-AP addition request received from AP1; S13 AP2 generates a security key GTK according to the STA Security info information of the terminal entity STA that needs to perform multi-connection operations; S14 AP2 sends an Association response message to the multi-link terminal STA MLD, which includes the security key GTK; S15 The multi-link terminal STA MLD uses the received security key GTK to encrypt and decrypt the data of the multi-connection; AP1 and AP2 encrypt and decrypt the data of the multi-connection operation of the multi-link terminal STA MLD according to the security key GTK.

2. A method for establishing secure multiple connections between a terminal and multiple access points according to claim 1, characterized in that: The selection strategies include an RSSI selection strategy based on received signal strength sorting and an adjacent AP selection strategy based on adjacent AP information.

3. The method for establishing secure multiple connections between a terminal and multiple access points according to claim 1, characterized in that: The Multi connection element parameter is used to describe the setting of the multi-link terminal STA MLD requesting to establish multiple connections; In step S6 to step S7, it includes an S-AP Address parameter for describing the S-AP address, a STA MC mode parameter for describing the request for the multi-connection mode; an S-AP maximum bit rate parameter for describing the upper limit of the transmission rate between the terminal entity STA and the S-AP in the multi-connection mode; an S-AP TID parameter for describing the service identifier supported by the terminal entity STA on the S-AP in the multi-connection; and an STA Authentication info parameter for describing the authentication information of the STA, wherein the STA MC mode parameter is set to Split: indicating that the data separation mode is used, that is, data is sent or received on two APs at the same time; and the STA MC mode parameter is set to Switch: indicating that the data exchange mode is used, that is, data is sent or received on two APs alternately in segments; In step S10 to step S11, it includes a Status code parameter for describing the response message result; a Dialog token parameter for identifying the current session; a STA MC mode parameter for describing the request for multi-connection mode; a UL split threshold parameter that exists when the STA MCmode parameter is split and is used to indicate the threshold value for uplink data separation; an S-AP Address parameter for describing the S-AP address; a STA S-AP maximum bit rate parameter for confirming the upper limit of the transmission rate of the S-AP in a multi-connection operation; and an S-AP Authentication info parameter for the authentication information of the S-AP.

4. The method for establishing secure multiple connections between a terminal and multiple access points according to claim 3, characterized in that: The STA Authentication info parameters include an SNonce parameter for recording a random number generated by the terminal entity STA; an R0KH-ID parameter for recording a PMK-R0 management entity identifier; and a PMKR0Name parameter for recording a first-level name of a paired master key.

5. The method for establishing secure multiple connections between a terminal and multiple access points according to claim 3, characterized in that: The S-AP addition request message is used to request AP2 to serve as a primary network access point S-AP, and includes a Dialog token parameter for identifying the current session; a STA ID parameter for identifying a multi-link terminal STAMLD requesting to use a multi-connection operation; an AP MC mode parameter for describing a mode for requesting multiple connections; a STA S-AP maximum bit rate parameter for describing a maximum transmission rate requested for a terminal entity STA on the S-AP in multiple connections; a STA S-AP TID parameter for describing a data service type requested for a terminal entity STA to transmit on the S-AP in multiple connections; and a STA Authentication info parameter for describing authentication information of the terminal entity STA; wherein the AP MC mode parameter is set to MC overP-AP: indicating that data of the S-AP and P-AP are aggregated or distributed on the P-AP; the AP MC mode parameter is set to MC overDS: indicating that data of the S-AP and P-AP are aggregated or distributed on a DS server; and the STA Authentication info parameter is consistent with the Association request message received by AP1 in step S6.

6. The method for establishing secure multiple connections between a terminal and multiple access points according to claim 5, characterized in that: If the STA MC mode parameter requested by the multi-link terminal STA MLD in the Association request is set to split, AP1 sets the AP MC mode parameter to MC over P-AP; if the STA MC mode parameter requested by the multi-link terminal STA MLD in the Association request is set to switch, AP1 sets the AP MC mode parameter to MC over DS.

7. The method for establishing secure multiple connections between a terminal and multiple access points according to claim 6, characterized in that: When the status code value is success, the S-AP addition response message includes a Status code parameter for describing the result of the response message; Dialog token parameter used to identify the current session; AP MC mode parameter used to confirm the multi-connection mode; STA ID parameter used to identify the terminal entity STA; STA S-AP maximum bit rate parameter used to record the upper limit of the transmission rate confirmed by the S-AP in the multi-connection operation; STA S-AP TID parameter used to record the service identification supported by the S-AP in the multi-connection operation; S-AP Authenticationinfo parameter used to record the S-AP authentication information; wherein the Dialog token parameter is set to the value of the Dialogtoken parameter in the received S-AP addition request message; the S-AP Authentication info parameter is set to include the SNonce parameter used to record the random number generated by the terminal entity STA; the ANonce parameter used to record the random number generated by the S-AP; the R0KH-ID parameter used to record the PMK-R0 management entity identifier; the R1KH-ID parameter used to record the PMK-R1 management entity identifier; the PMKR0Name parameter used to record the first-level name of the paired master key; When the status code value is fail; the S-AP addition response message includes a Status code parameter for describing the result of the response message; a Dialog token parameter for identifying the current session; a Cause value parameter for setting the reason for not agreeing to the request, and the Cause value parameter includes TID not supported: all TIDs requested are not supported; MAP not enabled: multi-connection operation is not enabled; BitRate not supported: the maximum transmission rate requested is not supported; Authentication failed: authentication failed; In step S12, the STA Security info parameters include the SNonce parameter for recording the random number generated by the terminal entity STA; the ANonce parameter for recording the random number generated by the S-AP; the R0KH-ID parameter for recording the PMK-R0 management entity identifier; the R1KH-ID parameter for recording the PMK-R1 management entity identifier; and the PMKR1Name parameter for recording the second-level name of the pairwise master key.

8. The method for establishing secure multiple connections between a terminal and multiple access points according to claim 7, characterized in that: If the STA MC mode parameter in the Association response message received by the multi-link terminal STA MLD from AP1 is split, when the size of the uplink data to be sent is greater than or equal to the value of the parameter UL split threshold, the uplink data to be sent is divided among the terminal entities STA and sent to AP1 and AP2 at the same time; If the STA MC mode parameter value in the Association response message received by the multi-link terminal STA MLD from AP1 is switch, adjustment is made according to the local policy, wherein the local policy includes sending data to AP2 when the signal strength / signal quality of AP1 is poor; and sending data to AP2 when the load of AP1 is heavy.

9. The method for establishing secure multiple connections between a terminal and multiple access points according to claim 7, characterized in that: If the AP MC mode parameter value in the S-AP addition response message sent by AP2 to AP is MC over P-AP, the received multi-link terminal STA MLD data is sent to AP1; If the AP MC mode parameter value in the S-AP addition response message sent by AP2 to AP is MC over DS, the received data of the multi-link terminal STA MLD is directly sent to the DS server.

10. The method for establishing secure multiple connections between a terminal and multiple access points according to claim 1, characterized in that: The security key GTK generated in step S7 is added to the Association response message in step S10, and steps S11 to S14 are skipped.

Images