Wireless communication method and related communication device

Abstract

The application provides a wireless communication method and related device. The wireless communication method suitable for an access point comprises the following steps: receiving an association request from a station; reading a pairwise master key identifier (PMKID) and a media access control (MAC) address of the station from the association request; if the PMKID does not match the content of a cache table, calculating the original PMKID by using the MAC address of the station, wherein the cache table stores a plurality of reference MAC addresses and corresponding reference PMKIDs; determining whether the original PMKID matches any reference PMKID in the cache table; and if the original PMKID matches one of the reference PMKIDs in the cache table, determining that the reference MAC address recorded in the cache table corresponding to the matched reference PMKID and the MAC address in the association request belong to the same station. By using the application, the reconnection time is shortened and the privacy is better.

Description

Technical Field

[0001] This disclosure generally relates to communication technologies, and more specifically, to wireless communication methods and apparatus associated with randomized media access control (MAC) addresses, which have a fast reconnection mechanism. Background Technology

[0002] A Media Access Control (MAC) address is a unique string of letters and numbers used to identify a device on a network and allow it to communicate with other devices. MAC addresses are typically assigned during device manufacturing and usually remain unchanged when moving from one network to another. In other words, MAC addresses are historically static and unique to each device. However, because access points (APs) or any Wi-Fi sniffer can monitor a device's location via its MAC address without the user's consent, this unique MAC address can negatively impact user privacy.

[0003] To address this issue, MAC address randomization is provided, allowing user devices to connect to the access point (AP) using different MAC addresses. This prevents eavesdroppers from using MAC addresses to establish a history of device activity. While MAC address randomization enhances user privacy, some fast reconnection mechanisms, such as pairwise master key security association (PMKSA) caching, may become unavailable. Specifically, when a device first connects to the AP, it initiates 802.1X / SAE (Simultaneous Authentication of Equals) authentication. Upon successful authentication, both the device and the AP store the derived pairwise master key (PMK) and pairwise master key identifier (PMKID) in an internal cache. The PMK and PMKID are associated with the device's MAC address. Therefore, if a device disconnects from the AP for some reason and needs to reconnect, it can simply reconnect using the PMK and PMKID if it has the same MAC address, without needing 802.1X / SAE authentication. However, if the device reconnects to the AP using a different MAC address, the PMKSA caching reconnection method will fail, and a time-consuming 802.1X / SAE authentication process will be required again. Summary of the Invention

[0004] In view of this, one of the objectives of the present invention is to provide a wireless communication method and related apparatus that allows a device to reconnect to an AP using MAC address randomization and PMKSA caching, thereby solving the above-mentioned problems.

[0005] According to an embodiment of the present invention, a wireless communication method (applicable to a site) includes the following steps: connecting to an access point (AP) by using a first media access control (MAC) address and performing authentication to generate a reference pairwise master key (PMK) and a corresponding reference pairwise master key identifier (PMKID); if the connection between the site and the AP is interrupted and the site attempts to reconnect to the AP, generating an association request containing information including the site's second MAC address and a PMKID associated with the reference PMKID (e.g., the PMKID is generated using the second MAC address and the reference PMKID), wherein the association request does not contain the site's first MAC address; and sending the association request to the AP.

[0006] In some embodiments, the step of generating an association request containing information about a second MAC address of the site and a PMKID associated with the reference PMKID includes: mixing the second MAC address with the reference PMKID to generate a mixed PMKID; and generating an association request containing the second MAC address and the mixed PMKID.

[0007] In some embodiments, the step of generating an association request that includes information including a second MAC address of the site and a PMKID associated with the reference PMKID includes: mixing the second MAC address with the reference PMKID to generate a mixed PMKID; encrypting the mixed PMKID using the reference PMKID to generate an encrypted PMKID; and generating an association request that includes the second MAC address and the encrypted PMKID.

[0008] In some embodiments, the step of mixing the second MAC address with the reference PMKID to generate a mixed PMKID includes: performing an XOR operation on the second MAC address and the reference PMKID to generate the mixed PMKID.

[0009] In some embodiments, the association request also includes information elements indicating that the site supports random MAC addresses and the PMKSA caching mechanism.

[0010] According to another embodiment of the present invention, a wireless communication method for an access point includes the following steps: receiving an association request from a site; reading a PMKID and a MAC address of the site from the association request; calculating the original PMKID using the MAC address of the site; determining whether the original PMKID matches any reference PMKID in a cache table, wherein the cache table stores a plurality of reference media access control (MAC) addresses and corresponding reference pairwise master key identifiers (PMKIDs); and if the original PMKID matches one of the reference PMKIDs in the cache table, determining that the reference MAC address recorded in the cache table corresponding to the matching reference PMKID and the MAC address in the association request belong to the same site.

[0011] In some embodiments, before calculating the original PMKID using the MAC address of the site, the method further includes: checking whether the PMKID carried in the association request matches the contents of the cache table (such as any reference PMKID); wherein, if the PMKID does not match the contents of the cache table, the original PMKID is calculated using the MAC address of the site.

[0012] In some embodiments, the step of using the MAC address of the site to calculate the PMKID to obtain the original PMKID includes: mixing the MAC address with the PMKID to generate a mixed PMKID as the original PMKID.

[0013] In some embodiments, the step of using the MAC address of the site to calculate the original PMKID includes: using at least one reference PMKID corresponding to the PMK in the cache table to decrypt the PMKID to generate a decrypted PMKID; and mixing the MAC address with the PMKID to generate a mixed PMKID as the original PMKID.

[0014] In some embodiments, the method further includes: if the original PMKID matches one of the reference PMKIDs in the cache table, then updating the reference MAC recorded in the cache table using the MAC address recorded in the association request.

[0015] In some embodiments, the cache table further includes information on whether the site corresponding to the reference MAC address supports random MAC addresses and the PMKSA caching mechanism.

[0016] In some embodiments, the step of using the MAC address of the site to calculate the original PMKID includes: referring to the cache table to select at least one site that supports the random MAC address and PMKSA caching mechanism; using the PMK corresponding to the selected site to decrypt the PMKID to generate the decrypted PMKID; and mixing the MAC address with the PMKID to generate a mixed PMKID as the original PMKID.

[0017] In some embodiments, the step of mixing the MAC address with the PMKID to generate a mixed PMKID as the original PMKID includes: performing an XOR operation on the MAC address and the PMKID to generate the mixed PMKID as the original PMKID.

[0018] According to another embodiment of the present invention, a communication device is provided that is suitable for a site, wherein the communication device includes a transceiver and a processor, the transceiver and the processor being configured to perform the following operations: connecting to an access point (AP) by using a first media access control (MAC) address and performing authentication to generate a reference pair master key (PMK) and a corresponding reference pair master key identifier (PMKID);

[0019] If the connection between the site and the AP is interrupted and the site attempts to reconnect to the AP, an association request is generated containing the site's second MAC address and information about the PMKID associated with the reference PMKID, wherein the association request does not contain the site's first MAC address; and the association request is sent to the AP.

[0020] In some embodiments, the step of generating an association request containing information including a second MAC address of the site and a PMKID associated with the reference PMKID includes: mixing the second MAC address with the reference PMKID to generate a mixed PMKID; encrypting the mixed PMKID using the reference PMKID to generate an encrypted PMKID; and generating an association request containing the second MAC address and the encrypted PMKID.

[0021] According to another embodiment of the present invention, a communication apparatus is provided, suitable for an access point, including a transceiver and a processor, the transceiver and the processor being configured to perform the following operations: receiving an association request from a site; reading a pairwise master key identifier (PMKID) and the media access control (MAC) address of the site from the association request; calculating the PMKID using the MAC address of the site to obtain an original PMKID; determining whether the original PMKID matches any reference PMKID in a cache table, wherein the cache table stores a plurality of reference MAC addresses and corresponding reference PMKIDs; and, if the original PMKID matches one of the reference PMKIDs in the cache table, determining that the reference MAC address recorded in the cache table corresponding to the matching reference PMKID and the MAC address in the association request belong to the same site.

[0022] In some embodiments, before calculating the original PMKID using the MAC address of the site, the method further includes performing the following operations: checking whether the PMKID carried in the association request matches the content in the cache table; wherein, if the PMKID does not match the content in the cache table, the PMKID is calculated using the MAC address of the site to obtain the original PMKID.

[0023] In some embodiments, the step of using the MAC address of the site to calculate the original PMKID includes: using at least one reference PMKID corresponding to the PMK in the cache table to decrypt the PMKID to generate a decrypted PMKID; and mixing the MAC address with the PMKID to generate a mixed PMKID as the original PMKID.

[0024] These and other objects of the invention will be readily understood by those skilled in the art upon reading the following detailed description of the preferred embodiments illustrated in the accompanying drawings. A detailed description will be given in the following embodiments with reference to the accompanying drawings. Attached Figure Description

[0025] A more complete understanding of the invention can be obtained by reading the following detailed description and referring to the examples given in the accompanying drawings, wherein:

[0026] Figure 1 This is a schematic diagram of a wireless communication system according to an embodiment of the present invention.

[0027] Figure 2A This is a flowchart illustrating a method for establishing a link between a site and an AP using SAE authentication according to an embodiment of the present invention.

[0028] Figure 2B This is a schematic diagram of a method for establishing a link between a site and an access point using 802.1X authentication, provided as an embodiment of the present invention.

[0029] Figure 3 This is a flowchart illustrating a method for establishing a connection between a site and an AP using PMKSA caching according to an embodiment of the present invention.

[0030] Figure 4A This is a flowchart illustrating a method for establishing a link between a site and an AP using SAE authentication according to another embodiment of the present invention.

[0031] Figure 4B This is a flowchart illustrating a method for establishing a link between a site and an AP using 802.1X authentication according to another embodiment of the present invention.

[0032] Figure 5 This is a flowchart illustrating a method for establishing a connection between a site and an AP using PMKSA caching according to another embodiment of the present invention.

[0033] Figure 6 This is a block diagram of an exemplary communication system according to an embodiment of the present invention.

[0034] In the following detailed description, numerous specific details are set forth for illustrative purposes so that those skilled in the art can more thoroughly understand the embodiments of the invention. However, it will be apparent that one or more embodiments may be practiced without these specific details, and different embodiments may be combined as needed, and should not be limited to the embodiments illustrated in the accompanying drawings. Detailed Implementation

[0035] The following description illustrates preferred embodiments of the present invention and is intended only to exemplify the technical features of the invention, not to limit the scope of the invention. Throughout this specification and claims, certain terms are used to refer to specific elements. Those skilled in the art should understand that manufacturers may use different names for the same element. Therefore, this specification and claims do not distinguish elements by differences in name, but rather by differences in function. The terms "element," "system," and "device" used in this invention can refer to computer-related entities, where the computer can be hardware, software, or a combination of hardware and software. The terms "comprising" and "including" as used in the following description and claims are open-ended terms and should be interpreted as "comprising, but not limited to...". Furthermore, the term "coupled" refers to an indirect or direct electrical connection. Therefore, if a device is described as coupled to another device, it means that the device can be directly electrically connected to the other device, or indirectly electrically connected to the other device through other devices or connection means.

[0036] Unless otherwise indicated, the corresponding numbers and symbols in the various figures generally refer to the corresponding parts. The figures are drawn to clearly illustrate the relevant parts of the embodiments and are not necessarily drawn to scale.

[0037] The terms "basically" or "roughly" as used in this document mean that, within an acceptable range, a person skilled in the art can solve the technical problem to be solved and basically achieve the desired technical effect. For example, "roughly equal to" means a method that a person skilled in the art can accept with a certain margin of error from "exactly equal to" without affecting the correctness of the result.

[0038] Figure 1 This is a schematic diagram of a wireless communication system according to an embodiment of the present invention. Figure 1 As shown, the wireless communication system includes an access point (AP) 110 and multiple stations STA1-STAn. AP 110 includes a processor 112 and a wireless communication module 114. In this embodiment, each of the stations STA1-STAn can be a mobile phone, tablet computer, laptop computer, or any other electronic device capable of wirelessly communicating with AP 110; this invention does not impose any limitations on this.

[0039] Figure 2A This is a flowchart illustrating a method for establishing a link between site STA1 and AP 110 using SAE authentication according to an embodiment of the present invention. Figure 2AAs shown, initially, site STA1 connects to AP 110, and both STA1 and AP 110 perform SAE authentication to establish a link. Upon successful authentication, STA1 and AP 110 typically derive a PMK (Paired Master Key), and their corresponding PMKIDs (Paired Master Key Identifiers) are also calculated. This set of information is called the PMKSA (Paired Master Key Security Association), which includes the PMK and its corresponding PMKID. Then, site STA1 stores the AP 110's Basic Service Set Identifier (BSSID) (i.e., the AP 110's MAC address). AP ) and the PMKID corresponding to stations STA1 and AP110 (PMKID) STA1_AP AP 110 will send the MAC address of station STA1. STA1 and the corresponding PMKID (PMKID) STA1_AP This is stored in a cache table, which also includes the MAC addresses and corresponding PMKIDs of other sites. For example, the cache table also includes the MAC address of site STA2. STA2 and PMKID STA2_AP ... and, for the MAC address of site STAN STAn and PMKID STAn_AP In the following description, the MAC address and PMKID (Paired Master Key Identifier) ​​stored in the cache table of AP 110 are referred to as the reference MAC address and reference PMKID, respectively. It should be noted that SAE authentication and the generation of PMK / PMKID are well known to those skilled in the art; therefore, related descriptions will not be repeated herein. In another optional embodiment, each entry in the cache table may also include / store the reference PMK corresponding to the reference PMKID, but the present invention does not impose any limitations on this, because PMKID and PMK are used in pairs. That is, when the AP knows the PMKID, it can usually know the corresponding PMK. In another optional embodiment, the reference PMKID and its corresponding reference PMK may not be located in the same cache table.

[0040] Then, station STA1 and AP 110 perform an association and a four-way handshake using the extended authentication protocol over LAN (EAPOL) for further communication between station STA1 and AP 110, such as performing normal send and receive operations (labeled "EAPOL4way / Normal TRX" in the diagram).

[0041] Figure 2A The steps for deriving the PMKSA shown use SAE authentication. In some embodiments, the steps for deriving the PMKSA (Paired Master Key Security Association) can be 802.1X authentication, such as... Figure 2B As shown, it establishes PMKSA between site STA1 and the backend EAP authentication server.

[0042] In some cases, station STA1 may lose connection to AP 110 for various reasons, such as station STA1 moving away from AP 110. If station STA1 is then moved back to a location near AP 110, it will automatically reconnect to AP 110. Additionally, for better privacy, station STA1 can use a randomized MAC address to connect to AP 110; that is, the MAC address used by station STA1 in this reconnection procedure is the same as the MAC address used in the previous connection. STA1 The difference lies in the MAC address used. In this embodiment, although site STA1 uses a different MAC address, site STA1 and AP 110 can use open authentication and PMKSA caching to quickly establish a connection without using 802.1X / SAE authentication, i.e., fast authentication. Specifically, refer to... Figure 3 This illustrates a flowchart of a method for establishing a connection between station STA1 and AP 110 using PMKSA caching according to an embodiment of the present invention. At step 300, the process begins. In step 302, station STA1 sends the new MAC address... STA1new With PMKID STA1_AP Mix to generate a mixed PMKID (such as...) Figure 3 The "M(MAC)" in the middle STA1new In one embodiment, station STA1 can perform a new MAC address and PMKID test. STA1_APAn exclusive OR (XOR) operation is performed to generate the mixed PMKID. Then, site STA1 uses the PMKID. STA1_AP The corresponding PMK (pair master key) is then used to encrypt the mixed PMKID to generate an encrypted PMKID (such as...). Figure 3 The "E" marked in the middle PMK (M(MAC STA1new ,PMKID))”).

[0043] In step 304, station STA1 sends an association request to AP 110, wherein the association request carries the encrypted PMKID (e.g., for PMKID). STA1_AP The pair of master key identifiers formed after mixing and / or encryption processing, for example, the PMKID field of this association request includes the encrypted PMKID generated in step 302. It should be noted that the association request also includes the new MAC address of site STA1. STA1new However, this does not include previous MAC addresses. STA1 To protect device privacy, when a site wishes to reconnect to the AP, it sends an association request including a random MAC address (typically different from the MAC address of the previous / first connection) and a PMKID. In one embodiment, the PMKID carried in the association request is a PMKID obtained by processing a reference PMKID, for example, by mixing and / or encrypting it to ensure it cannot be identified. In another embodiment, the PMKID carried in the association request is a reference PMKID. It is understood that this invention, by carrying the PMKID in the association request, is compatible with existing processing methods.

[0044] In step 306, AP 110 receives the association request from station STA1, and AP 110 determines whether the PMKID in the PMKID field (i.e., the encrypted PMKID mentioned above) matches... Figure 2A and Figure 2BThe process involves matching any PMKID in the cache table shown. Understandably, step 306 is for compatibility with STAs that do not use random MAC addresses (i.e., the current processing method), allowing a direct determination of whether a match exists. If a match is found, a connection can be quickly established. If a match is found, the process proceeds to step 314 (i.e., determining that the reference MAC address recorded in the cache table corresponding to the matching reference PMKID and the MAC address in the association request belong to the same site); if no match is found, the process proceeds to step 308. In this embodiment, since the PMKID field of the association request contains the encrypted PMKID generated using the hybrid and encryption steps, the PMKID in the association request (i.e., the encrypted PMKID) will not match the PMKID in the cache table. STA1_AP PMKID STA2_AP , ..., PMKID STAn_AP Any one of them.

[0045] In step 308, AP 110 sequentially uses the PMK of each site to decrypt the PMKID carried in the association request to generate a decrypted PMKID. Understandably, for n entries stored in the cache table (e.g., each entry includes a reference MAC address and a corresponding reference PMKID), step 308 will obtain n decrypted PMKIDs. For example, AP 110 uses the PMK of site STA1 to decrypt the PMKID in the association request (e.g., the encrypted PMKID described above) to generate the first decrypted PMKID, uses the PMK of site STA2 to decrypt the PMKID in the association request to generate the second decrypted PMKID, ..., and uses the PMK of site STAN to decrypt the PMKID in the association request to generate the nth decrypted PMKID. In this embodiment, the first decrypted PMKID generated using the PMK of site STA1 should be equal to the mixed PMKID generated in step 302.

[0046] In step 310, for each decrypted PMKID generated in step 308, AP 110 will associate the decrypted PMKID with the new MAC address. STA1new The original PMKID is generated by mixing (e.g., using an XOR operation), and AP 110 determines whether any one of the original PMKIDs (e.g., n) matches a PMKID in the cache table. STA1_AP PMKID STA2_AP ... PMKID STAn_APIf one of them matches, the process proceeds to step 314; otherwise, it proceeds to step 316. In this embodiment, the original PMKID generated using the PMK of site STA1 should be equal to PMKID. STA1_AP (i.e., the reference PMKID corresponding to STA1).

[0047] It should be noted that steps 308 and 310 can be combined into one step. Once AP 110 detects that the original PMKID being processed matches the PMKID in the cache table... STA1_AP PMKID STA2_AP ... PMKID STAn_AP If one of them matches, AP 110 stops using the remaining PMK to decrypt the PMKID. For example, in this embodiment, the original PMKID generated using the PMK of site STA1 is equal to the PMKID located in the first row of the cache table. STA1_AP Therefore, AP110 does not need to use the PMK of any of the other sites STA2–STAn to decrypt the PMKID, thus further saving connection time.

[0048] In step 314 (i.e., determining that the reference MAC address recorded in the cache table corresponding to the matching reference PMKID and the MAC address in the association request belong to the same site), AP 110 sends an association response to site STA1 indicating successful reconnection. For example, the status code of the association response indicates successful reconnection. In other words, PMKSA fast authentication is successful. Additionally, AP 110 uses MAC... STA1new Replace MAC STA1 This allows for updating the cache table, preserving design flexibility, but this embodiment of the invention does not impose any limitations on it.

[0049] In step 316, AP 110 sends an association response to site STA1 indicating that the PMKID in the association request is invalid. For example, the status code of the association response indicates that the PMKID in the association request is invalid. In other words, PMKSA fast authentication failed, and a full authentication process, such as 802.1X authentication or SAE authentication, needs to be performed again.

[0050] In this embodiment, after step 314, since station STA1 successfully connects to AP110 by utilizing the PMKSA cache (fast authentication successful using the PMKSA cache), station STA1 and AP110 can directly perform EAPOL (4-way handshake) to conduct further communication between station STA1 and AP110 without performing 802.1X / SAE authentication.

[0051] In conclusion, Figure 2A , Figure 2B and Figure 3 In the illustrated embodiment, the site can effectively reconnect to AP 110 using MAC address randomization and PMKSA caching without performing 802.1X / SAE authentication. Therefore, the site will have shorter connection times.

[0052] It should be noted that the encryption operation in step 302 and the decryption operation in step 308 are optional. For example, the PMKID field of the association request sent by site STA1 may include the new MAC address. STA1new With PMKID STA1_AP The resulting mixed PMKID, and AP 110 will use the PMKID carried in the association request (such as the mixed PMKID) and the new MAC address carried in the association request. STA1new The MAC address is mixed to generate the original PMKID (such as the reference PMKID obtained during the initial connection). This alternative design should fall within the scope of this invention. In another variant embodiment, station STA1 can directly encrypt the reference PMKID using the reference PMK (without performing the mixing operation using the new MAC address) and carry the encrypted PMKID in the association request. Accordingly, the AP sequentially uses the PMK corresponding to the PMKID in the cache table for decryption and other operations. Specifically, this invention does not impose any limitations on this.

[0053] Figure 4A This is a flowchart illustrating a method for establishing a link between site STA1 and AP 110 using SAE authentication according to another embodiment of the present invention. Figure 4A As shown, initially, station STA1 connects to AP 110, and both STA1 and AP 110 perform SAE authentication to establish a link. After successful authentication, STA1 and AP 110 typically derive their PMK and calculate their corresponding PMKIDs. This set of information is called PMKSA (Paired Master Key Security Association). Then, station STA1 stores AP 110's BSSID (i.e., AP 110's MAC address). AP) and the PMKID corresponding to stations STA1 and AP 110 (PMKID) STA1_AP ); and AP 110 will send the MAC address of station STA1. STA1 and the corresponding PMKID (PMKID) STA1_AP The MAC addresses and corresponding PMKIDs of other sites are stored in a cache table. For example, the cache table also includes the MAC address of site STA2. STA2 and PMKID STA2_AP And, the MAC address used for site STAN STAn and PMKID STAn_AP Optionally, the PMK corresponding to the PMKID can also be stored in the same cache table as the PMKID. Furthermore, in communication between station STA1 and AP 110, beacons or probe responses from AP 110 can contain an information element indicating that AP 110 supports random MAC addresses and the PMKSA caching mechanism. Similarly, association requests from station STA1 can also include an information element indicating that station STA1 supports random MAC addresses and the PMKSA caching mechanism. For example, this information element could be a vendor information element. Therefore, AP 110 can mark one or more stations supporting this mechanism in the cache table.

[0054] Then, site STA1 and AP 110 perform association and EAPOL (4-way handshake) to further communicate between site STA1 and AP 110.

[0055] Figure 4A The steps for deriving PMKSA shown use SAE certification. The steps for deriving PMKSA can also be 802.1X certified, such as... Figure 4B As shown, PMKSA is established between site STA1 and the backend EAP authentication server.

[0056] In some cases, station STA1 may lose connection to AP 110 for various reasons, such as being taken away from AP 110. If station STA1 is then moved back to a location near AP 110, it will automatically reconnect. Furthermore, for better privacy, station STA1 uses a random MAC address to connect to AP 110; that is, the MAC address used by station STA1 in this reconnection process is the same as the MAC address used in the previous connection. STA1Different. In this embodiment, although site STA1 uses a different MAC address, site STA1 and AP 110 can quickly establish a connection using open authentication and PMKSA caching, instead of using 802.1X / SAE authentication. Specifically, refer to... Figure 5 This illustrates a flowchart of a method for establishing a connection between station STA1 and AP 110 using PMKSA caching according to an embodiment of the present invention. In step 500, the process begins. In step 502, station STA1 sends the new MAC address... STA1new With PMKID STA1_AP The MAC address and PMKID are mixed to generate a hybrid PMKID. In one embodiment, station STA1 can perform a hybrid operation on the new MAC address and PMKID. STA1_AP An XOR operation is performed to generate the mixed PMKID. Then, station STA1 uses PMK (pair master key) to encrypt the mixed PMKID to generate the encrypted PMKID.

[0057] In step 504, station STA1 sends an association request to AP 110, including the PMKID. For example, the PMKID field in the association request includes the encrypted PMKID generated in step 502. It should be noted that the association request also includes the new MAC address of station STA1. STA1new However, this does not include previous MAC addresses. STA1 This is to protect device privacy. Furthermore, the association request from site STA1 may also include instructions indicating that it supports random MAC addresses and PMKSA caching mechanisms, such as a supplier information element instructing site STA1 to support random MAC addresses and PMKSA caching mechanisms.

[0058] In step 506, AP 110 refers to the supplier information element in the association request to determine whether site STA1 supports the random MAC address and PMKSA caching mechanism. If yes, the process proceeds to step 510; otherwise, the process proceeds to step 508.

[0059] In step 508, AP 110 determines whether the PMKID located in the association request (such as the PMKID field of the association request) is consistent with... Figure 4A and Figure 4B If any of the reference PMKIDs in the cache table shown matches, the process proceeds to step 516; otherwise, the process proceeds to step 518.

[0060] In step 510, AP 110 refers to a cache table to select at least a portion of one or more sites that support random MAC addresses and the PMKSA caching mechanism. AP 110 sequentially uses the PMK of the selected sites to decrypt the PMKID located in the association request to generate a decrypted PMKID. Specifically, AP 110 uses the PMK of site STA1 to decrypt the PMKID to generate the first decrypted PMKID, and uses the PMK of site STAN to decrypt the PMKID to generate the nth decrypted PMKID. In this embodiment, the first decrypted PMKID generated using the PMK of site STA1 should be equal to the mixed PMKID generated in step 502.

[0061] In step 512, for each decrypted PMKID generated in step 510, AP 110 will associate the decrypted PMKID with the new MAC address. STA1new The original PMKID is generated by mixing (e.g., using an XOR operation), and in step 514, AP 110 determines whether any of the original PMKIDs corresponds to a reference PMKID (such as PMKID) in the cache table corresponding to one or more sites that support random MAC addresses and PMKSA caching. STA1_AP ... PMKID STAn_AP If one of the following matches, the process proceeds to step 516; otherwise, it proceeds to step 518. In this embodiment, the original PMKID generated using the PMK of site STA1 should be equal to PMKID. STA1_AP .

[0062] It should be noted that steps 510 and 512 can be combined into one step. Once AP 110 finds that the currently processed original PMKID matches one of the reference PMKIDs corresponding to sites that support random MAC addresses and PMKSA caching in the cache table, AP 110 stops using the remaining PMK to decrypt the PMKID. Specifically, in this embodiment, the original PMKID generated using the PMK of site STA1 is equal to the PMKID located in the first row of the cache table. STA1_AP Therefore, AP 110 does not need to use the PMK decryption of any of the other sites STA2–STAn to decrypt the PMKID.

[0063] In step 516, the AP sends an association response to site STA1, where the status code of the association response indicates successful reconnection. Additionally, AP 110 uses MAC... STA1new Replace MAC STA1 Update the cache table.

[0064] In step 518, the AP sends an association response to site STA1, wherein the status code of the association response indicates that the PMKID in the association request is invalid.

[0065] In this embodiment, after step 516, since station STA1 successfully connects to AP 110 using the PMKSA cache, station STA1 and AP 110 can directly perform EAPOL (four-way handshake) to conduct further communication between station STA1 and AP 110 without performing 802.1X / SAE authentication.

[0066] It should be noted that the encryption operation in step 502 and the decryption operation in step 510 are optional. That is, the PMKID field of the association request sent by site STA1 can include a mixed PMKID, which is obtained by converting the new MAC address into a single MAC address. STA1new With PMKID STA1_AP The generated result, and AP 110 will carry the PMKID and the new MAC address in the association request. STA1new The original PMKID is generated by mixing. This alternative design should fall within the scope of this invention.

[0067] Figure 6 An example system 600 with at least example device 610 and example device 620 is shown according to embodiments of the present invention. Each of devices 610 and 620 can perform various functions to implement the schemes, techniques, processes, and methods described herein that allow devices to reconnect to an AP using MAC address randomization and PMKSA caching, including the various proposed designs, concepts, schemes, systems, and methods described above. For example, device 610 may be an example implementation of STA1, and device 620 may be an example implementation of an AP.

[0068] Each of devices 610 and 620 may be part of an electronic device, such as a STA or AP, like a portable or mobile device, a wearable device, a wireless communication device, or a computing device. For example, each of devices 610 and 620 may be implemented in a smartphone, smartwatch, personal digital assistant, digital camera, or computing device (such as a tablet, portable calculator, or laptop). Each of devices 610 and 620 may also be part of a machine-type device, such as an IoT device, like a stationary or fixed device, a home appliance, a wired communication device, or a computing device. For example, each of devices 610 and 620 may be implemented in a smart thermostat, a smart refrigerator, a smart door lock, a wireless speaker, or a home control center. When implemented in or as a network device, devices 610 and / or 620 may be implemented in network nodes, such as STAs and / or APs in a WLAN.

[0069] In some implementations, each of devices 610 and 620 may be implemented as one or more integrated circuit (IC) chips, such as, but not limited to, one or more single-core processors, one or more multi-core processors, one or more reduced-instruction-set-computing (RISC) processors, or one or more complex-instruction-set-computing (CISC) processors. In the various embodiments described above, each of devices 610 and 620 may be implemented in or as a STA or AP. Each of devices 610 and 620 may respectively include at least Figure 6 Some of the components shown, such as processor 612 and processor 622. Each of devices 610 and 620 may further include one or more other components (e.g., internal power supply, display device, and / or user interface device) unrelated to the proposed embodiments of the invention; therefore, for simplicity and brevity, such components are... Figure 6 Each of the devices 610 and 620 shown is not shown and will not be described below.

[0070] On one hand, each of processors 612 and 622 may be implemented as one or more single-core processors, one or more multi-core processors, one or more RISC processors, or one or more CISC processors. That is, although the singular term "processor" is used herein to refer to processors 612 and 622, each of processors 612 and 622 may include multiple processors in some implementations, and may include a single processor in other embodiments of the invention. On the other hand, each of processors 612 and 622 may be implemented as hardware (and optionally, solid-state) having electronic components including, for example, but not limited to, one or more transistors, one or more diodes, one or more capacitors, one or more resistors, one or more inductors, one or more memristors, and / or one or more varactor diodes, configured and arranged to perform a specific purpose according to embodiments of the invention. In other words, in at least some implementations, various implementations of embodiments of the invention, each of processors 612 and 622 is a dedicated machine specifically designed, arranged and configured to perform a specific task, including a scheme related to reconnecting to an AP using MAC address randomization and PMKSA caching in mobile communications.

[0071] In some implementations, device 610 may further include a transceiver 616 coupled to processor 612. Transceiver 616 is capable of wirelessly transmitting and receiving data. In some implementations, device 620 may further include a transceiver 626 coupled to processor 622. Transceiver 626 includes a transceiver capable of wirelessly transmitting and receiving data. Transceiver 616 of device 610 and transceiver 626 of device 620 can communicate with each other via a wireless network.

[0072] In some embodiments, device 610 may further include memory 614 coupled to and accessible by processor 612 and capable of storing data therein. In some embodiments, device 620 may further include memory 624 coupled to and accessible by processor 622 and capable of storing data therein. Each of memory 614 and memory 624 may include a type of random-access memory (RAM), such as dynamic RAM (DRAM), static RAM (SRAM), thyristor RAM (T-RAM), and / or zero-capacitor RAM (Z-RAM). Alternatively or additionally, each of memory 614 and memory 624 may include a type of read-only memory (ROM), such as mask ROM, programmable ROM (PROM), erasable programmable ROM (EPROM), and / or electrically erasable programmable ROM (EEPROM). Alternatively or additionally, each of memory 614 and memory 624 may include a type of non-volatile random-access memory (NVRAM), such as flash memory, solid-state memory, ferroelectric RAM (FeRAM), magnetoresistive RAM (MRAM), and / or phase-change memory.

[0073] Each of devices 610 and 620 may be a communication entity capable of communicating with each other using various proposed schemes according to the invention, for implementing the wireless communication method described above. In one embodiment, the transceiver and processor in device 610 are configured to: connect to an access point (AP) by using a first media access control (MAC) address and performing authentication to generate a reference pairwise master key (PMK) and a corresponding reference pairwise master key identifier (PMKID); if the connection between the station and the AP is interrupted and the station attempts to reconnect to the AP, generate an association request containing information including the station's second MAC address and PMKID (e.g., the PMKID is generated using the second MAC address and the reference PMKID), wherein the association request does not contain the station's first MAC address; and send the association request to the AP. In another embodiment, the transceiver and processor in device 620 are configured to: receive an association request from a site; read a PMKID (Paired Master Key Identifier) ​​and a reference Media Access Control (MAC) address of the site from the association request; calculate the original PMKID using the MAC address of the site; determine whether the original PMKID matches any reference PMKID in a cache table, wherein the cache table stores multiple MAC addresses and corresponding reference PMKIDs; and if the original PMKID matches one of the reference PMKIDs in the cache table, determine that the reference MAC address recorded in the cache table corresponding to the matching reference PMKID and the MAC address in the association request belong to the same site. Similar descriptions of other embodiments can be found in the foregoing embodiments, and will not be repeated here.

[0074] In conclusion, Figure 4A , Figure 4B , Figure 5 and Figure 6 In the illustrated embodiment, the site can efficiently reconnect to AP 110 using MAC address randomization and PMKSA caching without performing 802.1X / SAE authentication. Furthermore, AP 110 can decrypt the PMKID carried in the association request using only the PMK of a subset of the sites (e.g., those sites that support randomized MAC addresses and PMKSA caching). Therefore, the site's connection time is shorter. Additionally, with Figure 3 Compared to the illustrated embodiment, for association requests that include supplier information indicating that the site supports randomized MAC addresses and PMKSA caching, AP 110 only needs to process those PMK / PMKIDs corresponding to the sites that support randomized MAC addresses and PMKSA caching, instead of processing all PMK / PMKIDs in the cache table during steps 510, 512, and 514. Therefore, reconnection time can be further reduced.

[0075] While the invention has been described by way of example and according to preferred embodiments, it should be understood that the invention is not limited to the disclosed embodiments. Rather, it is intended to cover various variations and similar structures (as will be apparent to those skilled in the art), such as combinations or substitutions of different features in different embodiments. Therefore, the scope of the appended claims should be given the broadest interpretation to cover all such variations and similar structures.

Claims

1. A wireless communication method applicable to a site, characterized in that, The method includes: A connection to the access point (AP) is established by using the first media access control (MAC) address and performing authentication to generate a reference pair master key (PMK) and a corresponding reference pair master key identifier (PMKID). If the connection between the site and the AP is lost and the site attempts to reconnect to the AP, an association request is generated that includes the site's second MAC address and information about the PMKID associated with the reference PMKID, wherein the association request does not contain the site's first MAC address; and, Send the association request to the AP; The step of generating an association request that includes information such as the site's second MAC address and the PMKID associated with the reference PMKID includes: The second MAC address is mixed with the reference PMKID to generate a mixed PMKID; and, Generate an association request that includes the second MAC address and the combined PMKID.

2. The wireless communication method as described in claim 1, characterized in that, The step of generating an association request that includes information such as the site's second MAC address and the PMKID associated with the reference PMKID further includes: The reference PMK is used to encrypt the mixed PMKID to generate an encrypted PMKID, wherein the association request includes the second MAC address and the encrypted PMKID.

3. The wireless communication method as described in claim 2, characterized in that, The steps of mixing the second MAC address with the reference PMKID to generate the mixed PMKID include: Perform an XOR operation on the second MAC address and the reference PMKID to generate the mixed PMKID.

4. The wireless communication method as described in claim 1, characterized in that, The association request also includes information elements indicating that the site supports random MAC addresses and the PMKSA caching mechanism.

5. A wireless communication method applicable to an access point, characterized in that, The method includes: Receive association requests from the site; Read the pairwise master key identifier PMKID and the media access control MAC address of the site from the association request; The original PMKID is obtained by calculating the PMKID using the MAC address of the site. Determine whether the original PMKID matches any reference PMKID in the cache table, which stores multiple reference MAC addresses and their corresponding reference PMKIDs; and, If the original PMKID matches one of the reference PMKIDs in the cache table, it is determined that the reference MAC address recorded in the cache table corresponding to the matching reference PMKID and the MAC address in the associated request belong to the same site. The steps for calculating the original PMKID using the MAC address of the site include: The MAC address is mixed with the PMKID to generate a mixed PMKID, which is then used as the original PMKID.

6. The wireless communication method as described in claim 5, characterized in that, Before using the MAC address of the site to calculate the original PMKID, the method also includes: Check if the PMKID carried in the association request matches the content in the cache table; If the PMKID does not match the content in the cache table, the PMKID is calculated using the MAC address of the site to obtain the original PMKID.

7. The wireless communication method as described in claim 5, characterized in that, The steps of calculating the original PMKID using the MAC address of the site also include: Use at least one reference PMKID from the cache table to decrypt the PMKID to generate the decrypted PMKID; The original PMKID was generated by mixing the MAC address with the decrypted PMKID.

8. The wireless communication method as described in claim 5, characterized in that, The method also includes: If the original PMKID matches one of the reference PMKIDs in the cache table, then the reference MAC recorded in the cache table is updated using the MAC address recorded in the association request.

9. The wireless communication method as described in claim 5, characterized in that, The cache table also includes information on whether the site corresponding to the reference MAC address supports random MAC addresses and the PMKSA caching mechanism.

10. The wireless communication method as described in claim 7, characterized in that, The steps to calculate the original PMKID using the MAC address of the site also include: Refer to this cache table to select at least one site that supports random MAC addresses and the PMKSA caching mechanism; In this cache table, the PMK corresponding to the at least one reference PMKID is the PMK corresponding to the selected site.

11. The wireless communication method according to any one of claims 5, 7, and 10, characterized in that, The steps of mixing the MAC address with the PMKID to generate a mixed PMKID as the original PMKID include: Perform an XOR operation between the MAC address and the PMKID to generate the mixed PMKID, which will then be used as the original PMKID.

12. A communication device suitable for a site, characterized in that, The communication device includes a transceiver and a processor, and the transceiver and the processor are configured to perform the following operations: By using the first media access control MAC address and performing authentication to connect to the access point AP, a reference pair master key PMK and a corresponding reference pair master key identifier PMKID are generated; If the connection between the site and the AP is lost and the site attempts to reconnect to the AP, an association request is generated containing the site's second MAC address and information about the PMKID associated with the reference PMKID, wherein the association request does not contain the site's first MAC address; and, Send the association request to the AP; The step of generating an association request that includes information about the site's second MAC address and the PMKID associated with the reference PMKID includes: The second MAC address is mixed with the reference PMKID to generate a mixed PMKID; The mixed PMKID is encrypted using the reference PMK to generate the encrypted PMKID; and, Generate an association request containing the second MAC address and the encrypted PMKID.

13. A communication device suitable for an access point, characterized in that, The communication device includes a transceiver and a processor, and the transceiver and processor are configured to perform the wireless communication method as described in any one of claims 5 to 11.

Images