Associating a device with an access point using a credential

Abstract

Various aspects of the disclosure generally relate to wireless communication. In some aspects, a device can transmit, via a broadcast, a first frame indicating one or more of a device credential or a payload. The device can receive, from an access point, a second frame indicating one or more of the payload or an access point credential. The device can associate with the access point based at least in part on the access point credential. The device can perform, via the access point, a communication to a cloud computing device after the device has associated with the access point. Numerous other aspects are described.

Description

[0001] Cross-reference to related applications

[0002] This patent application claims priority to U.S. Provisional Patent Application No. 63 / 201,448, filed April 29, 2021, entitled "ASSOCIATING DEVICES WITH ACCESS POINTS USING CREDENTIALS," and U.S. Non-Provisional Patent Application No. 17 / 657,566, filed March 31, 2022, entitled "ASSOCIATING DEVICES WITH ACCESS POINTS USING CREDENTIALS," which are hereby expressly incorporated by reference.

[0003] open field

[0004] Various aspects of this disclosure generally relate to wireless communication, and to techniques and apparatus for associating devices with access points using credentials. Background Technology

[0005] Wireless communication systems are widely deployed to provide a variety of telecommunications services such as telephone, video, data, messaging, and broadcasting. Typical wireless communication systems employ multiple access technologies that can support communication with multiple users by sharing available system resources (e.g., bandwidth, transmit power). Examples of such multiple access technologies include Code Division Multiple Access (CDMA) systems, Time Division Multiple Access (TDMA) systems, Frequency Division Multiple Access (FDMA) systems, Orthogonal Frequency Division Multiple Access (OFDMA) systems, Single Carrier Frequency Division Multiple Access (SC-FDMA) systems, Time Division Synchronous Code Division Multiple Access (TD-SCDMA) systems, and Long Term Evolution (LTE). LTE / LTE-Advanced is an enhancement set of the Universal Mobile Telecommunications System (UMTS) mobile standard issued by the 3rd Generation Partnership Project (3GPP).

[0006] A wireless network may include one or more base stations that support communication for one or more user equipment (UEs). UEs may communicate with base stations via downlink and uplink communication. "Downlink" (or "DL") refers to the communication link from the base station to the UE, while "uplink" (or "UL") refers to the communication link from the UE to the base station.

[0007] The above multiple access technologies have been adopted in various telecommunications standards to provide a common protocol enabling different UEs to communicate at the city, country, region, and / or global levels. New Radio (NR) (which may be referred to as 5G) is an enhancement set of the LTE mobile standard issued by 3GPP. NR is designed to better support mobile broadband Internet access by using Orthogonal Frequency Division Multiplexing (OFDM) with a Cyclic Prefix (CP) (CP-OFDM) on the downlink, and CP-OFDM and / or Single Carrier Frequency Division Multiplexing (SC-FDM) (also known as Discrete Fourier Transform Extended OFDM (DFT-s-OFDM)) on the uplink, as well as supporting beamforming, multiple-input multiple-output (MIMO) antenna technologies and carrier aggregation to improve spectral efficiency, reduce costs, improve service, utilize new spectrum, and better integrate with other open standards. Further improvements to LTE, NR, and other radio access technologies remain useful as the demand for mobile broadband access continues to grow.

[0008] Overview

[0009] In some aspects, a wireless communication method performed by a device includes: transmitting a first frame via broadcast, the first frame indicating one or more of a device credential or a payload; receiving a second frame from an access point, the second frame indicating one or more of the payload or access point credential; associating the device with the access point at least in part based on the access point credential; and, after the device has been associated with the access point, performing communication to a cloud computing device via the access point.

[0010] In some aspects, a wireless communication method performed by an access point includes: receiving a first frame from a device via broadcast, the first frame indicating device credentials and a payload; relaying the payload together with access point credentials to a cloud computing system; receiving the payload and access point credentials from the cloud computing system at least in part based on authentication of the payload and the access point credentials; and associating the device with the access point at least in part based on the access point credentials to enable communication between the device and the cloud computing system via the access point.

[0011] In some aspects, a wireless communication method performed by a cloud computing system includes: receiving from an access point an indication of a payload and access point credentials associated with a device; authenticating the payload and access point credentials as specified in the indication; transmitting the payload and access point credentials to the access point at least in part based on the authentication of the payload and access point credentials; and communicating with the device via the access point at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials.

[0012] In some aspects, an apparatus for wireless communication includes: a memory and one or more processors coupled to the memory, configured to: transmit a first frame via broadcast, the first frame indicating one or more of a device credential or a payload; receive a second frame from an access point, the second frame indicating one or more of the payload or access point credential; associate with the access point at least in part based on the access point credential; and, after the device has been associated with the access point, perform communication to a cloud computing device via the access point.

[0013] In some aspects, an access point for wireless communication includes: a memory and one or more processors coupled to the memory, configured to: receive a first frame from a device via broadcast, the first frame indicating device credentials and a payload; relay the payload together with access point credentials to a cloud computing system; receive the payload and access point credentials from the cloud computing system at least in part based on authentication of the payload and the access point credentials; and associate the device at least in part based on the access point credentials to enable communication between the device and the cloud computing system via the access point.

[0014] In some aspects, a cloud computing system for wireless communication includes: a memory and one or more processors coupled to the memory, configured to: receive from an access point an indication of a payload and access point credentials associated with a device; verify the payload and access point credentials as specified in the indication; transmit the payload and access point credentials to the access point at least in part based on the verification of the payload and access point credentials; and communicate with the device via the access point at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials.

[0015] In some aspects, a non-transient computer-readable medium storing a set of instructions for wireless communication, the set of instructions comprising one or more instructions that, when executed by one or more processors of a device, cause the device to: broadcast a first frame indicating one or more of a device credential or a payload; receive a second frame from an access point indicating one or more of the payload or access point credential; associate with the access point at least in part based on the access point credential; and, after the device has been associated with the access point, perform communication to a cloud computing device via the access point.

[0016] In some aspects, a non-transient computer-readable medium storing a set of instructions for wireless communication includes: one or more instructions that, when executed by one or more processors of an access point, cause the access point to: receive a first frame from a device via broadcast, the first frame indicating device credentials and a payload; relay the payload together with the access point credentials to a cloud computing system; receive the payload and the access point credentials from the cloud computing system at least in part based on authentication of the payload and the access point credentials; and associate the device at least in part based on the access point credentials to enable communication between the device and the cloud computing system via the access point.

[0017] In some aspects, a non-transient computer-readable medium storing a set of instructions for wireless communication, the set of instructions comprising one or more instructions that, when executed by one or more processors of a cloud computing system, cause the cloud computing system to: receive from an access point an indication of a payload and access point credentials associated with a device; verify the payload and access point credentials as specified in the indication; transmit the payload and access point credentials to the access point at least in part based on the verification of the payload and access point credentials; and communicate with the device via the access point at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials.

[0018] In some aspects, an apparatus for wireless communication includes: means for transmitting a first frame via broadcast, the first frame indicating one or more of an apparatus credential or a payload; means for receiving a second frame from an access point, the second frame indicating one or more of the payload or access point credential; means for associating with the access point at least in part based on the access point credential; and means for performing communication to a cloud computing device via the access point after the apparatus has been associated with the access point.

[0019] In some aspects, an apparatus for wireless communication includes: means for receiving a first frame from a device via broadcast, the first frame indicating a device credential and a payload; means for relaying the payload together with the device credential to a cloud computing system; means for receiving the payload and the device credential from the cloud computing system based at least in part on authentication of the payload and the device credential; and means for associating with the device based at least in part on the device credential to enable communication between the device and the cloud computing system via the apparatus.

[0020] In some aspects, an apparatus for wireless communication includes: means for receiving from an access point an indication of a payload and access point credentials associated with a device; means for verifying the payload and access point credentials as specified in the indication; means for transmitting the payload and access point credentials to the access point at least in part based on the verification of the payload and access point credentials; and means for communicating with the device via the access point at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials.

[0021] The aspects generally include, as described herein with reference to the accompanying drawings and description, methods, apparatus, systems, computer program products, non-transient computer-readable media, user equipment, base stations, wireless communication equipment and / or processing systems, as illustrated in the drawings and description.

[0022] The foregoing has broadly outlined the features and technical advantages of the examples according to this disclosure in an effort to facilitate a better understanding of the following detailed description. Additional features and advantages will be described thereafter. The disclosed concepts and specific examples can be readily used as the basis for modifying or designing other structures for implementing the same purposes as this disclosure. Such equivalent constructions do not depart from the scope of the appended claims. The characteristics of the concepts disclosed herein, in both their organization and manner of operation, and their associated advantages, will be better understood by considering the following description in conjunction with the accompanying drawings. Each drawing is provided for illustrative and descriptive purposes and not for defining limitations on the claims.

[0023] While aspects are described herein by way of example, those skilled in the art will understand that such aspects can be implemented in many different arrangements and scenarios. The techniques described herein can be implemented using different platform types, devices, systems, shapes, sizes, and / or package layouts. For example, some aspects may be implemented via integrated chip embodiments or other devices based on non-modular components (e.g., end-user devices, vehicles, communication devices, computing devices, industrial equipment, retail / shopping devices, medical devices, and / or artificial intelligence devices). Aspects can be implemented in chip-level components, modular components, non-modular components, non-chip-level components, device-level components, and / or system-level components. Devices incorporating the described aspects and features may include additional components and features for implementing and practicing the claimed and described aspects. For example, the transmission and reception of wireless signals may include one or more components for analog and digital purposes (e.g., hardware components including antennas, radio frequency (RF) chains, power amplifiers, modulators, buffers, processors, interleavers, adders, and / or summers). The aspects described herein are intended to be practiced in a wide variety of devices, components, systems, distributed arrangements, and / or end-user devices of various sizes, shapes, and configurations. Brief description of the attached diagram

[0025] To gain a more detailed understanding of the features described above in this disclosure, reference can be made to various aspects of the above brief overview, some of which are illustrated in the accompanying drawings. However, it should be noted that the drawings illustrate only certain typical aspects of this disclosure and should not be considered as limiting its scope, as other equivalent aspects are permissible in this description. Identical reference numerals in different drawings may identify the same or similar elements.

[0026] Figure 1 This is a diagram illustrating an example of a wireless network according to this disclosure.

[0027] Figure 2 This is a diagram illustrating an example of communication between a base station and a user equipment (UE) in a wireless network according to this disclosure.

[0028] Figure 3 This is a diagram illustrating an example of the uplink broadcast characteristics according to this disclosure.

[0029] Figure 4 and Figure 5A This is a diagram illustrating an example of associating a device with an access point according to the usage certificate in accordance with this disclosure.

[0030] Figure 5B This is a diagram illustrating an example of relaying associated with an access point co-located with the same agent according to this disclosure.

[0031] Figure 5C This is a diagram illustrating an example of relaying associated with access points co-located with different agents according to this disclosure.

[0032] Figure 6-8 This is a diagram illustrating an example process of associating a device with an access point using a credential, as described in this disclosure.

[0033] Figure 9-11 This is a block diagram of an example apparatus for wireless communication according to the present disclosure.

[0034] Detailed description

[0035] Various aspects of this disclosure are described more fully below with reference to the accompanying drawings. However, this disclosure may be implemented in many different forms and should not be construed as being limited to any specific structure or function given throughout this disclosure. Rather, these aspects are provided so that this disclosure will be thorough and complete, and will fully convey the scope of this disclosure to those skilled in the art. Those skilled in the art will appreciate that the scope of this disclosure is intended to cover any aspect of this disclosure disclosed, whether implemented independently of or in combination with any other aspect of this disclosure. For example, any number of aspects set forth herein may be used to implement an apparatus or method of practice. Furthermore, the scope of this disclosure is intended to cover such apparatus or methods practiced using additional structures, functionalities, or structures and functionalities that complement or supplement the various aspects of this disclosure set forth herein. It should be understood that any aspect of this disclosure disclosed herein may be implemented by one or more elements of the claims.

[0036] Several aspects of a telecommunications system will now be described with reference to various devices and techniques. These devices and techniques will be described in the following detailed description and explained in the accompanying drawings by various blocks, modules, components, circuits, steps, processes, algorithms, etc. (collectively, "elements"). These elements can be implemented using hardware, software, or a combination thereof. Whether such elements are implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system.

[0037] Although the aspects herein may be described using terms commonly associated with 5G or New Radio (NR) Radio Access Technology (RAT), the aspects of this disclosure may be applied to other RATs, such as 3G RAT, 4G RAT, and / or RATs after 5G (e.g., 6G).

[0038] Figure 1This is a diagram illustrating an example of a wireless network 100 according to this disclosure. The wireless network 100 may be a 5G (e.g., NR) network and / or a 4G (e.g., LTE) network, or may include elements thereof. The wireless network 100 may include one or more base stations 110 (shown as BS110a, BS110b, BS110c, and BS110d), one or more user equipment (UE) 120 (shown as UE 120a, UE 120b, UE 120c, UE 120d, and UE 120e), and / or other network entities. Base station 110 is the entity that communicates with UE 120. Base station 110 (sometimes referred to as BS) may include, for example, an NR base station, an LTE base station, a B-node, an eNB (e.g., in 4G), a gNB (e.g., in 5G), an access point, and / or a transmit / receive point (TRP). Each base station 110 may provide communication coverage for a specific geographic area. In the 3rd Generation Partnership Project (3GPP), the term "cell" can refer to the coverage area of ​​base station 110 and / or the base station subsystem serving that coverage area, depending on the context in which the term is used.

[0039] Base station 110 provides communication coverage to macrocells, picocells, femtocells, and / or another type of cell. Macrocells can cover a relatively large geographic area (e.g., a radius of several kilometers) and allow unrestricted access by UE 120 with a service subscription. Picocells can cover a relatively small geographic area and allow unrestricted access by UE 120 with a service subscription. Femtocells can cover a relatively small geographic area (e.g., a residential area) and allow restricted access by UE 120 associated with that femtocell (e.g., UE 120 in a closed subscriber group (CSG)). Base station 110 for macrocells may be referred to as a macro base station. Base station 110 for picocells may be referred to as a pico base station. Base station 110 for femtocells may be referred to as a femtocell or a home base station. Figure 1 In the example shown, BS110a can be a macro base station for macro cell 102a, BS110b can be a pico base station for pico cell 102b, and BS110c can be a femto base station for femto cell 102c. A base station may support one or more (e.g., three) cells.

[0040] In some aspects, the term "base station" (e.g., base station 110) or "network entity" may refer to an aggregated base station, a decomposed base station, an integrated access and backhaul (IAB) node, a relay node, and / or one or more components thereof. For example, in some aspects, "base station" or "network entity" may refer to a central unit (CU), a distributed unit (DU), a radio unit (RU), a near real-time (near RT) RAN intelligent controller (RIC), or a non-real-time (non-RT) RIC, or a combination thereof. In some aspects, the term "base station" or "network entity" may refer to a device configured to perform one or more functions (such as those described herein in conjunction with base station 110). In some aspects, the term "base station" or "network entity" may refer to multiple devices configured to perform one or more functions. For example, in some distributed systems, each of multiple different devices (which may be located in the same geographical location or different geographical locations) may be configured to perform at least a portion of a function, or to repeat the performance of at least a portion of that function, and the term "base station" or "network entity" may refer to any one or more of these different devices. In some respects, the term "base station" or "network entity" may refer to one or more virtual base stations and / or one or more virtual base station functions. For example, in some respects, two or more base station functions may be instantiated on a single device. In some respects, the term "base station" or "network entity" may refer to one base station function rather than another. In this way, a single device may include more than one base station.

[0041] In some examples, the cell may not necessarily be stationary, and the geographical area of ​​the cell may move depending on the location of the mobile base station 110 (e.g., a mobile base station). In some examples, base stations 110 may interconnect with each other and / or interconnect to one or more other base stations 110 or network nodes (not shown) in the wireless network 100 using any suitable transport network via various types of backhaul interfaces (such as direct physical connections or virtual networks).

[0042] Wireless network 100 may include one or more relay stations. A relay station is an entity capable of receiving data transmissions from an upstream station (e.g., base station 110 or UE 120) and transmitting those data transmissions to a downstream station (e.g., UE 120 or base station 110). A relay station may be a UE 120 capable of relaying transmissions for other UE 120s. Figure 1 In the example shown, BS110d (e.g., a relay base station) can communicate with BS110a (e.g., a macro base station) and UE 120d to facilitate communication between BS110a and UE 120d. The base station 110 for relay communication may be referred to as a relay station, relay base station, relay, etc.

[0043] Wireless network 100 can be a heterogeneous network comprising different types of base stations 110 (such as macro base stations, pico base stations, femto base stations, or relay base stations, etc.). These different types of base stations 110 may have different transmit power levels, different coverage areas, and / or different effects on interference in wireless network 100. For example, macro base stations may have high transmit power levels (e.g., 5 to 40 watts), while pico base stations, femto base stations, and relay base stations may have lower transmit power levels (e.g., 0.1 to 2 watts).

[0044] Network controller 130 can be coupled to or communicate with a group of base stations 110 and can provide coordination and control over these base stations 110. Network controller 130 can communicate with base stations 110 via backhaul communication links. Base stations 110 can communicate with each other directly or indirectly via wireless or wired backhaul communication links.

[0045] Each UE 120 may be distributed throughout the wireless network 100, and each UE 120 may be stationary or mobile. UE 120 may include, for example, access terminals, terminals, mobile stations, and / or subscriber units. UE 120 may be a cellular phone (e.g., a smartphone), a personal digital assistant (PDA), a wireless modem, a wireless communication device, a handheld device, a laptop computer, a cordless phone, a wireless local loop (WLL) station, a tablet device, a camera, a gaming device, a netbook, a smartbook, an ultrabook, a medical device, a biometric device, a wearable device (e.g., a smartwatch, smart clothing, smart glasses, a smart wristband, smart jewelry (e.g., a smart ring or smart bracelet)), an entertainment device (e.g., a music device, a video device, and / or a satellite radio), an in-vehicle component or sensor, a smart meter / sensor, industrial manufacturing equipment, a GPS device, or any other suitable device configured to communicate via a wireless medium.

[0046] Some UEs 120 may be considered Machine-Type Communication (MTC) UEs, or evolved or enhanced Machine-Type Communication (eMTC) UEs. MTC UEs and / or eMTC UEs may include, for example, robots, drones, remote devices, sensors, meters, monitors, and / or location tags, which can communicate with a base station, another device (e.g., a remote device), or some other entity. Some UEs 120 may be considered Internet of Things (IoT) devices, and / or may be implemented as NB-IoT (Narrowband IoT) devices. Some UEs 120 may be considered client equipment. UE 120 may be included within a housing that houses the components of UE 120, such as processor components and / or memory components. In some examples, the processor components and memory components may be coupled together. For example, the processor components (e.g., one or more processors) and memory components (e.g., memory) may be operatively coupled, communicatively coupled, electronically coupled, and / or electrically coupled.

[0047] Generally, any number of wireless networks 100 can be deployed in a given geographical area. Each wireless network 100 can support a specific RAT and can operate on one or more frequencies. A RAT may be referred to as a radio technology, air interface, etc. A frequency may be referred to as a carrier, frequency channel, etc. Each frequency can support a single RAT in a given geographical area to avoid interference between wireless networks using different RATs. In some cases, NR or 5G RAT networks can be deployed.

[0048] In some examples, two or more UEs 120 (e.g., shown as UE 120a and UE 120e) may communicate directly using one or more sidelink channels (e.g., without using base station 110 as an intermediary). For example, UEs 120 may communicate using peer-to-peer (P2P) communication, device-to-device (D2D) communication, vehicle-to-everything (V2X) protocols (e.g., which may include vehicle-to-vehicle (V2V) protocols, vehicle-to-infrastructure (V2I) protocols, or vehicle-to-pedestrian (V2P) protocols), and / or mesh networks. In such examples, UEs 120 may perform scheduling operations, resource selection operations, and / or other operations described elsewhere herein as performed by base station 110.

[0049] Devices in Wireless Network 100 can communicate using the electromagnetic spectrum, which can be subdivided into various categories, bands, channels, etc., according to frequency or wavelength. For example, each device in Wireless Network 100 can communicate using one or more operating frequency bands. In 5G NR, two initial operating frequency bands have been designated as frequency ranges FR1 (410MHz–7.125GHz) and FR2 (24.25GHz–52.6GHz). It should be understood that although a portion of FR1 is greater than 6GHz, FR1 is generally (interchangeably) referred to as the “sub-6GHz” band in various documents and articles. Similar naming issues sometimes arise regarding FR2; although different from the Very High Frequency (EHF) band (30GHz–300GHz) designated as the “millimeter wave” band by the International Telecommunication Union (ITU), FR2 is generally (interchangeably) referred to as the “millimeter wave” band in various documents and articles.

[0050] The frequencies between FR1 and FR2 are generally referred to as intermediate frequency (IF) bands. Recent 5G NR studies have designated the operating bands of these IF bands as the frequency range designation FR3 (7.125 GHz – 24.25 GHz). Bands falling within FR3 can inherit FR1 and / or FR2 characteristics, thus effectively extending the features of FR1 and / or FR2 into the IF band. Additionally, higher frequency bands are currently being explored to extend 5G NR operation above 52.6 GHz. For example, three higher operating frequency bands have been designated as the frequency range designations FR4a or FR4-1 (52.6 GHz – 71 GHz), FR4 (52.6 GHz – 114.25 GHz), and FR5 (114.25 GHz – 300 GHz). Each of these higher frequency bands falls within the EHF band.

[0051] Considering the examples above, unless otherwise stated, it should be understood that, as used herein, the terms "sub-6GHz," etc., can broadly refer to frequencies less than 6GHz, within FR1, or that may include intermediate frequency band frequencies. Furthermore, unless otherwise stated, it should be understood that, as used herein, the terms "millimeter wave," etc., can broadly refer to frequencies that may include intermediate frequency band frequencies, within FR2, FR4, FR4-a, or FR4-1 and / or FR5, or within the EHF band. It is conceivable that the frequencies included in these operating frequency bands (e.g., FR1, FR2, FR3, FR4, FR4-a, FR4-1, and / or FR5) can be modified, and the techniques described herein are applicable to those modified frequency ranges.

[0052] In some aspects, the device (e.g., UE 120) may include a communications manager 140. As described in more detail elsewhere herein, the communications manager 140 may broadcast a first frame indicating one or more of a device credential or payload; receive a second frame from an access point indicating one or more of the payload or access point credential; associate with the access point at least in part based on the access point credential; and, after the device has been associated with the access point, perform communication to a cloud computing device via the access point. Additionally or alternatively, the communications manager 140 may perform one or more other operations described herein.

[0053] As indicated above, Figure 1 This is provided as an example. Other examples may differ from the one provided. Figure 1 The example described.

[0054] Figure 2 This is a diagram illustrating an example 200 of communication between a base station 110 and a UE 120 in a wireless network 100 according to this disclosure. The base station 110 may be equipped with a set of antennas 234a to 234t, such as T antennas (T≥1). The UE 120 may be equipped with a set of antennas 252a to 252r, such as R antennas (R≥1).

[0055] At base station 110, transmit processor 220 can receive data from data source 212 intended for UE 120 (or a group of UEs 120). Transmit processor 220 can select one or more modulation and coding schemes (MCS) for UE 120, at least in part, based on one or more Channel Quality Indicators (CQIs) received from UE 120. Base station 110 can process (e.g., encode and modulate) the data for UE 120, at least in part, based on the selected MCS(s) for UE 120, and can provide data symbols to UE 120. Transmit processor 220 can process system information (e.g., semi-static resource partitioning information (SRPI)) and control information (e.g., CQI requests, grants, and / or higher-layer signaling), and provide overhead symbols and control symbols. Transmit processor 220 can generate reference symbols for reference signals (e.g., a cell-specific reference signal (CRS) or demodulation reference signal (DMRS)) and synchronization signals (e.g., a primary synchronization signal (PSS) or secondary synchronization signal (SSS)). Transmit (TX) multiple-input multiple-output (MIMO) processor 230 can perform spatial processing (e.g., precoding) on ​​data symbols, control symbols, overhead symbols, and / or reference symbols, where applicable, and can provide a set of output symbol streams (e.g., T output symbol streams) to a corresponding set of modems 232 (e.g., T modulators) (shown as modems 232a to 232t). For example, each output symbol stream can be provided to a modulator component (shown as MOD) of modem 232. Each modem 232 can use a corresponding modulator component to process the corresponding output symbol stream (e.g., for OFDM) to obtain an output sample stream. Each modem 232 may further use a corresponding modulator component to process (e.g., convert to analog, amplify, filter, and / or upconvert) the output sample stream to obtain a downlink signal. Modems 232a to 232t may transmit a set of downlink signals (e.g., T downlink signals) via a corresponding set of antennas 234 (e.g., T antennas) (shown as antennas 234a to 234t).

[0056] At UE 120, an antenna set 252 (shown as antennas 252a to 252r) can receive downlink signals from base station 110 and / or other base stations 110 and can provide a set of received signals (e.g., R received signals) to a set of modems 254 (e.g., R modems) (shown as modems 254a to 254r). For example, each received signal can be provided to a demodulator component (shown as DEMOD) of modem 254. Each modem 254 can use a corresponding demodulator component to condition (e.g., filter, amplify, downconvert, and / or digitize) the received signal to obtain an input sample. Each modem 254 can use the demodulator component to further process the input sample (e.g., for OFDM) to obtain received symbols. A MIMO detector 256 can obtain the received symbols from modem 254, perform MIMO detection on these received symbols where applicable, and can provide detected symbols. The receiver processor 258 can process (e.g., demodulate and decode) these detected symbols, provide decoded data for UE 120 to data sink 260, and provide decoded control and system information to controller / processor 280. The term "controller / processor" can refer to one or more controllers, one or more processors, or a combination thereof. The channel processor can determine Reference Signal Received Power (RSRP) parameters, Received Signal Strength Indicator (RSSI) parameters, Reference Signal Received Quality (RSRQ) parameters, and / or CQI parameters, etc. In some examples, one or more components of UE 120 may be included in housing 284.

[0057] Network controller 130 may include communication unit 294, controller / processor 290, and memory 292. Network controller 130 may include one or more devices, such as those in the core network. Network controller 130 may communicate with base station 110 via communication unit 294.

[0058] One or more antennas (e.g., antennas 234a to 234t and / or antennas 252a to 252r) may include one or more antenna panels, one or more antenna groups, one or more antenna element assemblies, and / or one or more antenna arrays, etc., or may be included therein. Antenna panels, antenna groups, antenna element assemblies, and / or antenna arrays may include one or more antenna elements (within a single housing or multiple housings), coplanar antenna element assemblies, non-coplanar antenna element assemblies, and / or coupled to one or more transmit and / or receive components (such as...) Figure 2 One or more antenna elements (one or more components).

[0059] On the uplink, at UE 120, transmit processor 264 can receive and process data from data source 262 and control information from controller / processor 280 (e.g., reports including RSRP, RSSI, RSRQ, and / or CQI). Transmit processor 264 can generate reference symbols for one or more reference signals. Symbols from transmit processor 264 may be pre-encoded by TX MIMO processor 266 where applicable, further processed by modem 254 (e.g., for DFT-s-OFDM or CP-OFDM), and transmitted to base station 110. In some examples, modem 254 of UE 120 may include modulator and demodulator. In some examples, UE 120 includes a transceiver. The transceiver may include any combination of antennas 252, modems 254, MIMO detector 256, receive processor 258, transmit processor 264, and / or TX MIMO processor 266. The transceiver can be used by a processor (e.g., controller / processor 280) and memory 282 to perform aspects of any of the methods described herein (e.g., references). Figure 4-8 ).

[0060] At base station 110, uplink signals from UE 120 and / or other UEs may be received by antenna 234, processed by modem 232 (e.g., demodulator component of modem 232, shown as DEMOD), detected by MIMO detector 236 where applicable, and further processed by receiver processor 238 to obtain decoded data and control information transmitted by UE 120. Receiver processor 238 may provide the decoded data to data sink 239 and the decoded control information to controller / processor 240. Base station 110 may include communication unit 244 and may communicate with network controller 130 via communication unit 244. Base station 110 may include scheduler 246 to schedule one or more UEs 120 for downlink and / or uplink communication. In some examples, modem 232 of base station 110 may include modulator and demodulator. In some examples, base station 110 includes transceiver. The transceiver may include any combination of antennas 234, modems 232, MIMO detectors 236, receiver processors 238, transmitter processors 220, and / or TX MIMO processors 230. The transceiver may be used by a processor (e.g., controller / processor 240) and memory 242 to perform aspects of any of the methods described herein (e.g., references). Figure 4-8 ).

[0061] The controller / processor 240 of base station 110, the controller / processor 280 of UE 120, and / or Figure 2Any other component thereof may perform one or more technologies associated with associating a device with an access point using credentials, as described elsewhere in this document in more detail. In some respects, the device described herein is UE 120, is included in UE 120, or includes... Figure 2 One or more components of the UE 120 shown herein. In some respects, the access point described herein includes... Figure 2 One or more components of the UE 120 shown or one or more components of the base station 110. In some aspects, the cloud computing system described herein includes Figure 2 This refers to one or more components of the UE 120 or one or more components of the base station 110. For example, the controller / processor 240 of the base station 110, the controller / processor 280 of the UE 120, and / or Figure 2 Any other component may execute or direct, for example Figure 6 Process 600 Figure 7 The process 700 Figure 8 The operation of process 800 and / or other processes as described herein. Memory 242 and memory 282 may store data and program code for base station 110 and UE 120, respectively. In some examples, memory 242 and / or memory 282 may include a non-transient computer-readable medium storing one or more instructions (e.g., code and / or program code) for wireless communication. For example, one or more instructions, when executed by one or more processors of base station 110 and / or UE 120 (e.g., directly executed, or executed after compilation, transformation, and / or interpretation), may cause the one or more processors, UE 120 and / or base station 110 to perform or direct, for example... Figure 6 Process 600 Figure 7 The process 700 Figure 8 The operation of process 800, and / or other processes described herein. In some examples, the execution instructions may include run instructions, transform instructions, compile instructions, and / or interpret instructions, etc.

[0062] In some aspects, the device (e.g., UE 120) includes: means for transmitting a first frame via broadcast, the first frame indicating one or more of a device credential or a payload; means for receiving a second frame from an access point, the second frame indicating one or more of the payload or access point credential; means for associating with the access point at least in part based on the access point credential; and / or means for performing communication to a cloud computing device via the access point after the device has been associated with the access point. In some aspects, the means for the device to perform the operations described herein may include, for example, one or more of the following: a communication manager 140, an antenna 252, a demodulator 254, a MIMO detector 256, a receive processor 258, a transmit processor 264, a TX MIMO processor 266, a modulator 254, a controller / processor 280, or a memory 282.

[0063] In some aspects, the access point includes: means for receiving a first frame from a device via broadcast, the first frame indicating device credentials and a payload; means for relaying the payload together with access point credentials to a cloud computing system; means for receiving the payload and access point credentials from the cloud computing system at least in part based on authentication of the payload and the access point credentials; and / or means for associating with the device at least in part based on the access point credentials to enable communication between the device and the cloud computing system via the access point. In some aspects, the means for the access point to perform the operations described herein may include, for example, one or more of the following: a transmit processor 220, a TX MIMO processor 230, a modulator 232, an antenna 234, a demodulator 232, a MIMO detector 236, a receive processor 238, a controller / processor 240, a memory 242, or a scheduler 246.

[0064] In some aspects, a cloud computing system includes: means for receiving from an access point an indication of a payload and access point credentials associated with a device; means for verifying the payload and access point credentials as specified in the indication; means for transmitting the payload and access point credentials to the access point at least in part based on the verification of the payload and access point credentials; and / or means for communicating with the device via the access point at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials. In some aspects, means for the cloud computing system to perform the operations described herein may include, for example, one or more of a transmit processor 220, a TX MIMO processor 230, a modulator 232, an antenna 234, a demodulator 232, a MIMO detector 236, a receive processor 238, a controller / processor 240, a memory 242, or a scheduler 246.

[0065] although Figure 2The boxes in the diagram are interpreted as different components, but the functions described above with respect to these boxes can be implemented using a single hardware component, software component, or combination of components. For example, the functions described with respect to transmit processor 264, receive processor 258, and / or TX MIMO processor 266 can be performed by controller / processor 280 or under the control of controller / processor 280.

[0066] As indicated above, Figure 2 This is provided as an example. Other examples may differ from the one provided. Figure 2 The example described.

[0067] The Institute of Electrical and Electronics Engineers (IEEE) 802.11bc standard supports uplink broadcast features. Devices can broadcast uplink frames with higher-level protocol (HLP) payloads. These uplink frames can be Enhanced Broadcast Service (EBCS) uplink frames. Devices can be laptops, desktop computers, Wi-Fi phones, etc. Access points (APs), such as those at airports or supercharging stations, can receive uplink frames and forward (or relay) them to the destination specified in the uplink frame. Alternatively, an EBCS agent (a logical component that can be co-located with the AP) can provide EBCS relay service, relaying uplink frames to the destination specified in the uplink frame.

[0068] However, in some situations, the device broadcasting uplink frames can be an unassociated device, meaning that the device may not be associated with any AP capable of receiving uplink frame broadcasts. An AP may not forward data from uplink frames received from an unassociated device to a remote destination. In other words, when a device is not associated with an AP, it may not be able to send data frames to the AP because the AP may discard the data. To associate with an AP, an unassociated device may need to obtain credentials, such as security credentials. An unassociated device may not be configured to exchange signaling with the AP to obtain the credentials needed to associate with the AP, which allows the unassociated device to become associated with the AP and communicate with the cloud provider.

[0069] In various aspects of the technologies and apparatus described herein, a device may transmit uplink frames indicating device credentials and a payload (e.g., an HLP payload) via broadcast. The device may initially not be associated with any access point within its communication range. In other words, the device may initially not be associated with any access point within its communication range. Access points within the device's communication range may receive the uplink frames indicating device credentials and a payload. The access point may forward the payload along with access point credentials to a cloud provider associated with the cloud computing system. The access point may receive the payload and access point credentials from the cloud provider based at least in part on authentication of the payload and access point credentials. The access point may transmit downlink frames to the device, indicating the payload and access point credentials. The device may associate with the access point at least in part based on the access point credentials. After associating with an access point, the device may perform communication with the cloud provider via the access point. As a result, a device that may initially not be associated with any access point within its communication range may become associated with one or more access points to allow communication between the device and the cloud provider.

[0070] In some respects, operations described herein as being performed at the access point can be performed at an EBCS agent co-located with the access point. For example, the EBCS agent may receive uplink frames from the device, forward the payload indicated in the uplink frames to the cloud provider, receive the payload and EBCS agent credentials from the cloud provider, and associate with the device to enable communication between the device and the cloud provider via the EBCS agent.

[0071] In some respects, an EBCS agent can provide EBCS relay services to EBCS non-access point devices to transmit uplink frames with HLP payloads to the destination specified in the uplink frame. The HLP payload can be protected with end-to-end encryption. The EBCS agent can evaluate the uplink frame according to specific criteria before relaying the HLP payload carried in the uplink frame to the destination. For example, the EBCS agent can verify device credentials to determine whether the device transmitting the uplink frame is authorized to send the payload to the destination. The EBCS agent can evaluate this criterion based at least in part on local policies installed at the EBCS agent and / or at least in part on the relationship established between the EBCS agent and the cloud provider associated with the destination.

[0072] In some respects, the ability to provide unassociated devices with access to cloud providers can be useful in a variety of scenarios. For example, in a boarding scenario, a device might be able to access a ride-hailing service after its associated user arrives at the arrival hall of a foreign airport. As another example, electric vehicles might be able to upload sensor data through security passages while at charging stations. As yet another example, in a tracking scenario, smart luggage or smart packages might be able to send location data to a tracking service operating in a cloud environment.

[0073] In some respects, IEEE 802.11bc-based solutions for providing access to cloud providers to unassociated devices may differ from Wi-Fi hotspot-based solutions. In IEEE 802.11bc-based solutions, the AP may not need to advertise affiliated domains (or the cloud providers with which it has a relationship), and devices may not need to scan the media before sending uplink frames. Furthermore, IEEE 802.11bc-based solutions can follow stateless spontaneous or on-demand models because the AP can relay HLP payloads to the cloud provider and then no longer communicate with the devices. HLP payloads from multiple devices can be piggybacked to the same cloud provider. In Wi-Fi hotspot-based solutions, the AP may need to advertise the domains with which it has a relationship. Devices can scan the media to discover the AP and can query the AP to gather information about the cloud provider. Moreover, Wi-Fi hotspot-based solutions can follow stateful query-response protocols because the AP can maintain a dedicated session for each device, increasing the AP's workload and hindering scalability.

[0074] Figure 3 This is a diagram illustrating example 300 of the uplink broadcast characteristics according to this disclosure.

[0075] like Figure 3As shown, the device can transmit uplink frames (e.g., EBCS uplink frames) via broadcast. The uplink frames can be spontaneous frames transmitted via broadcast. The uplink frames can be received at a first AP (AP1), a second AP (AP2), and a third AP (AP3). The first AP, second AP, and third AP may not be associated with the device. The first AP and third AP may relay the uplink frames to the destination indicated in the uplink frame. The destination may be associated with a cloud provider. The uplink frames may carry a certificate associated with the device. The device may be pre-configured with a certificate, which may be self-signed and / or signed by the cloud provider. The first AP and third AP may relay the uplink frames at least in part based on their relationship with the cloud provider. When a relationship is established between the first AP and third AP and the cloud provider, the certificate associated with the device may be installed at the first AP and third AP. The first AP and third AP may verify the certificate associated with the device before relaying the uplink frames to the destination associated with the cloud provider. The first and third APs can respectively use the certificates associated with the device that are already installed at the first and third APs to verify the certificates associated with the device as indicated in the uplink frame. In some cases, the first and third APs can add additional information before relaying the uplink frame to the destination associated with the cloud provider.

[0076] In some cases, the second AP may not be affiliated with the cloud provider, and therefore the second AP may discard uplink frames. In other words, the second AP may not relay uplink frames used by the device.

[0077] As indicated above, Figure 3 This is provided as an example. Other examples may differ from the one provided. Figure 3 The example described.

[0078] Figure 4 This is a diagram illustrating example 400 of associating a device with an access point according to the usage credentials disclosed herein. (See diagram 400 for example.) Figure 4 As shown, Example 400 includes communication between a device (e.g., UE 120), an access point (e.g., a WiFi access point), and a cloud computing system. In some aspects, the device and access point may be included in a wireless network (such as wireless network 100).

[0079] In some respects, instead of the access point, the EBCS agent (which can be co-located with the access point) can communicate with devices and cloud computing systems. In other respects, the cloud computing system can be associated with a cloud provider.

[0080] In some respects, an access point may be attached to an EBCS agent to provide trunk services. However, an EBCS station (STA) attached to an EBCS agent and providing trunk services without establishing its own Infrastructure Basic Services (BSS) can be used instead of an access point. In some respects, an EBCS STA attached to an EBCS agent can be an access point that has already established its own Infrastructure BSS, or a STA that provides trunk services without establishing its own Infrastructure BSS.

[0081] As indicated by reference numeral 402, a device may transmit an uplink frame via broadcast, indicating device credentials, a payload, and a frame signature. In some aspects, the device credentials may be signed by a cloud computing system. The device credentials may be a device certificate. In some aspects, the payload may include a device identifier associated with the device, security credentials associated with the device, and / or service-specific information. In some aspects, the frame signature may be associated with the uplink frame and may be derived at least in part based on the device credentials. Furthermore, the uplink frame may indicate a Uniform Resource Identifier (URI) associated with a destination, which may be associated with a cloud computing system. In some aspects, the uplink frame may be the first frame.

[0082] In some aspects, device credentials may be device certificates pre-configured when the device is manufactured or when a specific application is installed on the device. This device certificate may be an STA certificate. In some aspects, the payload may be end-to-end protected using an asymmetric key between the device and the cloud computing system. For example, the payload (e.g., an HLP payload) may be encrypted using the public key of the cloud computing system, and only the cloud computing system can decrypt it using its private key. In some aspects, the security credentials associated with the device in the payload may be device credentials (e.g., an STA certificate). In some aspects, service-specific information may indicate the amount of data to be uploaded to the server, or the desired destination associated with the user (e.g., the user's desired location). The cloud provider system may provide additional information to the access point based at least in part on service-specific information, where the additional information may indicate the duration of the session and / or the amount of data permitted during the session. In some aspects, frame signatures may ensure that the content in an uplink frame is not tampered with. For example, if the content in an uplink frame is later modified, the frame signature calculated at the access point may not match the original frame signature.

[0083] In some respects, the device may not have been initially associated with an access point. For example, the device may not have been initially associated with any access point within its communication range.

[0084] In some aspects, a device may transmit uplink frames at least in part based on the fulfillment of a condition. For example, a condition may be fulfilled at least in part based on the launch of an application on the device. The application could be a ride-hailing app launched on the device after a user associated with the device arrives at the arrival hall of a foreign airport. As another example, a condition may be fulfilled at least in part based on the device performing a task. The task could involve the device (e.g., an electric vehicle) arriving at a charging station. In some aspects, a device may transmit uplink frames periodically. For example, a device could be a smart baggage or smart parcel that periodically transmits uplink frames to convey location data associated with the device.

[0085] As indicated by reference numeral 404 in the attached figure, the access point can verify the device credentials of the device, as indicated in the uplink frame, based at least in part on cloud computing system credentials previously installed on the access point. In other words, the access point can verify, at least in part, that the device is authorized to transmit payloads to the cloud computing system based on cloud computing system credentials. The device credentials may be signed by the cloud computing system.

[0086] In some respects, an access point may discard the contents of an uplink frame when certain conditions are met. The access point may discard the contents of an uplink frame if the device certificate subfield is present in the uplink frame and at least one of the following is true: the credential of the destination indicated in the uplink frame (e.g., a cloud computing system credential) or the credential of the central authority (e.g., a certificate authority) that signed the device credential is not installed; verification of the device credential using the installed destination credential or central authority credential fails; or the frame signature type subfield is not associated with higher-level authentication and verification of the frame signature using the device credential fails. The access point may discard the contents of an uplink frame if the replay protection subfield is present in the uplink frame and at least one of the following is true: the time subfield is set to a non-zero value and the difference between that non-zero value and the time the uplink frame was received meets a threshold (e.g., greater than an acceptable value); the frame count subfield is non-zero and less than or equal to the value in a previously received uplink frame (if any); or the frame count subfield is zero and the value in a previously received uplink frame (if any) is not equal to 2. 32 -1 or less (within an acceptable range).

[0087] In some aspects, the acceptable time difference at the access point can be configured at least partially based on a local policy or at least partially based on the relationship with the destination indicated in the uplink frame. In some aspects, the access point can store the last known frame count value according to its validity period. In some aspects, the access point can maintain a sliding window of the frame count value to handle packet loss and frame count subfield wrapping. The frame count subfield can wrap when multiple frames have been lost by access points in the neighborhood. The sliding window at the access point can be used for replay protection.

[0088] In some respects, access points can maintain a sliding window of frame count values ​​to handle packet loss and frame count subfield wrapping, where access points in the neighborhood have lost packets including those with frame count (FC) 2. 32 When multiple frames are in frames with FC=1 and FC=0, the frame count subfield can be wrapped. For example, it is possible to receive FC=2. 32 -4 frames can be received at FC=2 32 -3 frames can be received at FC=2 32 -2 frames can lose FC=2 32 A frame with FC=1 can be lost, a frame with FC=0 can be lost, a frame with FC=1 can be received, a frame with FC=2 can be received, and a frame with FC=3 can be received.

[0089] As shown by reference numeral 406 in the attached figure, an access point can relay a payload along with access point credentials to a cloud computing system. The access point can forward the payload along with access point credentials based at least in part on successful verification of device credentials. Access point credentials can be a temporary key (or temporary certificate) added to the payload to enable the device to become associated with the access point. In some cases, the access point can add additional information, such as an indication of the location associated with the device, based at least in part on a protocol with the cloud computing system. In some aspects, the access point can relay or forward the payload and access point credentials after evaluating the device credentials.

[0090] In some respects, the link between the access point and the cloud computing system can be secure. For example, Transport Layer Security (TLS) can be used to protect the link, establishing a secure Transmission Control Protocol (TCP) connection between the access point and the cloud computing system. As another example, Internet Protocol Security (IPsec) can be used to protect the link between the access network associated with the access point and the cloud computing system. In some respects, an EBCS proxy entity associated with the access point can be used to protect the link.

[0091] In some respects, the link between the access point and the cloud computing system can be secured, and the cloud computing system can verify that the information was received from a trusted access point. The cloud computing system can verify the access point at least in part based on the access point's credentials (e.g., the access point's certificate). This information can be encrypted using a security key established between the access point and the cloud computing system.

[0092] In some respects, asymmetric keys between the access point and the cloud computing system can be used to protect the content exchanged between them. The public key of the cloud computing system can be used to encrypt the frame content sent from the access point to the cloud computing system, and only the cloud computing system can use its private key to decrypt the frame content. Similarly, the public key of the access point can be used to encrypt the frame content from the cloud computing system to the access point, and only the access point can use its private key to decrypt the frame content.

[0093] In some respects, access points can communicate with cloud computing systems via entities on a local area network (LAN), such as network controllers. When multiple access points in a region are connected to cloud computing systems via a network controller, the network controller can maintain relationships with one or more cloud computing systems.

[0094] In some respects, after the payload and access point credentials have been forwarded to the cloud computing system, the access point can cease maintaining state information associated with the device. In other words, at this point, the access point may no longer maintain any state information about the device.

[0095] In some aspects, evaluation criteria, maintaining or managing relationships with cloud computing systems, adding additional information to the payload, or limiting the size of the payload relayed on behalf of the device can be performed at an EBCS agent entity associated with the access point. The EBCS agent entity may be co-located within the access point. Alternatively, the EBCS agent entity may be located in the LAN associated with the access point.

[0096] In some respects, EBCS agent entities can reside in public entities included in the local area network (LAN). One or more access points can connect to the public entity in the LAN where the EBCS agent entity resides.

[0097] As indicated by reference numeral 408 in the attached figure, the cloud computing system can verify the payload and access point credentials received from the access point. The cloud computing system can verify the payload based at least in part on device credentials. Furthermore, the cloud computing system can verify whether the payload and access point credentials received from the access point originate from a trusted access point, based at least in part on access point credentials.

[0098] As indicated by reference numeral 410 in the accompanying drawing, the cloud computing system may transmit payloads and access point credentials to an access point based at least in part on the verification of the payload and access point credentials. The payloads and access point credentials transmitted to the access point may be intended for use by the device.

[0099] As shown by reference numeral 412 in the accompanying drawing, the access point can transmit a downlink frame to the device, which indicates a payload and access point credentials. In other words, the access point can transmit a payload and access point credentials previously received from the cloud computing system. In some aspects, the access point can transmit the downlink frame to the device as a unicast transmission. In some aspects, the access point can transmit the downlink frame via a broadcast transmission. In this example, the downlink frame can be a beacon frame broadcast from the access point. The downlink frame can indicate a device identifier and access point credentials associated with the device. The device identifier can be a Media Access Control (MAC) address associated with the device, or a hash of the MAC address associated with the device. In some aspects, the downlink frame can be a second frame.

[0100] In some respects, the device may receive downlink frames from an access point. In some respects, the device may receive downlink frames via unicast transmission. In some respects, the device may receive downlink frames via broadcast transmission. In this case, the device may identify the MAC address or hash of the MAC address indicated in the downlink frame to identify that the payload and access point credentials are intended for use by the device.

[0101] As indicated by reference numeral 414, the device can retrieve access point credentials from downlink frames, at least in part, based on cloud computing system credentials. The device can also verify the payload and access point credentials, at least in part, based on cloud computing system credentials. In some aspects, asymmetric keys can be used to end-to-end protect the content (e.g., HLP content) in a second frame from the cloud computing system. The payload from the cloud computing system to the device can be encrypted using the device's public key, and only the device can decrypt it using its private key.

[0102] As indicated by reference numeral 416 in the accompanying drawings, the device may establish an association with an access point at least in part based on access point credentials. For example, the device may transmit an association request indicating device credentials to the access point. The device may receive an association response indicating access point credentials from the access point. The device may use the access point credentials as indicated in the downlink frame to verify the access point credentials as indicated in the association response. In some aspects, the device may establish an association with the access point at least in part based on public key-based authentication.

[0103] As shown by reference numeral 418 in the accompanying drawings, after the device has been associated with an access point, the device can communicate with the cloud computing system via the access point. The device may be able to communicate with the cloud computing system via the access point based at least in part on the association between the device and the access point, wherein the association may be based at least in part on access point credentials (e.g., a temporary key).

[0104] In some respects, the device may receive from the access point a list of addresses associated with cloud computing systems accessible to the device. The device may be unable to access addresses not indicated in the address list. In some respects, the device may receive instructions from the access point that limit the payload size of communications with the cloud computing system or the number of requests permitted to be forwarded from the access point to the cloud computing system on behalf of the device within a given time period. The payload size and the number of requests may be based at least in part on local policies at the access point or at least in part on the relationship between the access point and the cloud computing system. The device may perform communications with the cloud computing system based at least in part on the address list and / or instructions that limit the payload size and / or the number of requests.

[0105] In some respects, access points may limit the amount or frequency of relay payloads (e.g., HLP payloads) in a pre-association state (e.g., before an association is formed between the access point and the device). Access points (or EBCS proxy entities) and / or cloud computing systems may determine not to provide unrestricted relay of HLP payloads in a pre-association state (e.g., to prevent denial-of-service (DoS) attacks).

[0106] In some respects, the access point can send instructions to the device that limit the duration of the association between the device and the access point. The access point can then, at least in part, disassociate itself from the device after a specific time period based on these instructions (which may be received from a cloud computing system). From the device's perspective, the disassociation instruction could be a disassociation imminent message.

[0107] As indicated above, Figure 4 This is provided as an example. Other examples may differ from the one provided. Figure 4 The example described.

[0108] Figure 5A This is a diagram illustrating example 500 of associating a device with an access point according to the usage certificate as described in this disclosure. Figure 5A As shown, Example 500 includes communication between a device (e.g., UE 120), an access point (e.g., a WiFi access point), and a cloud provider that may be associated with a cloud computing system. In some aspects, the device and access point may be included in a wireless network (such as Wireless Network 100).

[0109] As indicated by reference numeral 502 in the accompanying drawings, the device may transmit uplink frames (e.g., EBCS uplink frames). The uplink frames may indicate device credentials that can be signed by the cloud provider. The uplink frames may indicate payloads (e.g., HLP payloads) that may indicate a device identifier, security credentials, service-specific details, and / or additional security fields for replay protection and / or frame signing. Uplink frames can only be decrypted by the cloud provider. The uplink frames may also indicate device credentials indicating that the uplink frames have been signed by the device.

[0110] In some respects, the device may transmit uplink frames based at least in part on conditions being met (such as when an electric vehicle begins charging at a supercharging station or when a user opens a ride-hailing app at an airport).

[0111] In some respects, access points in the vicinity of the device can receive uplink frames via broadcast. In other words, the access point is within the device's communication range. In some respects, the access point can verify the credentials indicated in the uplink frame. The access point can verify the device's credentials. The access point may be associated with a cloud provider, and the access point can verify whether the device is authorized to transmit payloads to the cloud provider. The access point can verify the device's credentials at least in part based on an installed cloud provider certificate, which may have been previously installed on the access point when the relationship between the access point and the cloud provider was established.

[0112] As indicated by reference numeral 504, the access point may relay the payload to the cloud provider based at least in part on the verification of device credentials. The access point may add access point credentials (e.g., a temporary key or temporary certificate) to the payload, which enables the device to establish an association with the access point. The access point may add additional information, such as an indication of the location associated with the device, based at least in part on a protocol between the access point and the cloud provider. After the access point has transmitted the payload and access point credentials, it may no longer maintain state information about the device.

[0113] In some respects, a cloud provider may verify, at least in part, that a frame containing a payload and access point credentials was received from a trusted access point based on access point credentials. The cloud provider may be able to verify access point credentials, at least in part, based on the relationship between the cloud provider and the access point. For example, the cloud provider may possess a copy of the access point credentials, and the access point may possess a copy of the cloud provider's credentials, which may be exchanged when the relationship between the cloud provider and the access point is established.

[0114] In some respects, the cloud provider may verify and decrypt the payload based at least in part on the relationship between the cloud provider and the device. The cloud provider may also verify and decrypt the payload based at least in part on device credentials, which may be obtained by the cloud provider when the relationship between the cloud provider and the device is established. Furthermore, the device may obtain a copy of the cloud provider's credentials when the relationship between the cloud provider and the device is established.

[0115] In some respects, access points can transmit payloads and access point credentials to cloud providers via entities within a local area network (such as network controllers). When multiple access points in a neighborhood are connected to one or more cloud providers via a network controller, the network controller can maintain its relationship with those cloud providers.

[0116] As indicated by reference numeral 506, the cloud provider may transmit a frame containing a payload and access point credentials to the access point. The payload, along with the access point credentials, may be intended for use with the device. The cloud provider may transmit the payload along with the access point credentials based at least in part on a frame containing the payload and the access point credentials received from the access point.

[0117] As indicated by reference numeral 508 in the attached figure, the access point can transmit the payload along with the access point credentials to the device. The access point can transmit the payload along with the access point credentials via broadcast transmission or via individually addressed frames.

[0118] In some respects, the device can at least partially rely on cloud provider credentials to verify the payload and retrieve information from the payload (e.g., access point credentials). In other words, the device can use cloud provider credentials to retrieve access point credentials carried in the payload.

[0119] As shown by reference numeral 510, a device can use access point credentials to perform a secure association with an access point. For example, the device can transmit an association request to the access point. The association request may indicate device credentials. The device can receive an association response from the access point that may indicate access point credentials. The device can verify access point credentials received from the access point during the association between the device and the access point, at least in part, based on the access point credentials received in the payload. In some aspects, the device can transmit the association request and receive the association response, at least in part, based on public key-based authentication, during the association between the device and the access point.

[0120] As indicated above, Figure 5A This is provided as an example. Other examples may differ from the one provided. Figure 5A The example described.

[0121] Figure 5B This is a diagram illustrating example 520 of relaying using an access point co-located with an agent, as described in this disclosure.

[0122] like Figure 5B As shown, relay operations can occur at an EBCS access point with a co-located EBCS agent. Relay service may be based at least in part on a relationship with a specified destination. EBCS agents P1 and P3 may have already established a relationship with the destination (D). An EBCS non-AP STA (S) may transmit EBCS UL frames received by EBCS APs (e.g., AP1, AP2, and AP3) in the neighborhood. The EBCS UL frame may carry an HLP payload, a field carrying the destination address, and other fields for security. EBCS agents P1 and P3 may verify the EBCS non-AP STA's certificate and perform a replay check, at least in part, based on the protocol with the destination, to determine whether the criteria for relaying the HLP payload to the destination have been met. When local policies or the protocol with the destination involve limiting the amount or frequency of HLP payloads sent to the destination, each of EBCS agents P1 and P3 may not send an HLP payload to the destination, at least in part, based on the determination that the limit has been met. When the protocol with the destination involves additional information, EBCS Agent P1 and EBCS Agent P3 may add appropriate information before relaying the HLP payload. EBCS AP2 may discard EBCS UL frames at least in part based on the following: EBCS AP2 does not provide relay services, EBCS AP2's co-location agent has not yet established a relationship with the destination, or one or more criteria used for relaying have not been met.

[0123] As indicated above, Figure 5B This is provided as an example. Other examples may differ from the one provided. Figure 5B The example described.

[0124] Figure 5C This is a diagram illustrating example 530 of relaying using an access point not co-located with an agent, as described in this disclosure.

[0125] like Figure 5CAs shown, relay operation can occur when the access point is not co-located with an EBCS agent. The EBCS agent (P) may not be co-located with EBCS AP1 or EBCS AP3, but may instead reside on an entity within the LAN associated with EBCS AP1 and EBCS AP3. EBCS AP1 and EBCS AP3 can relay the content of EBCS UL frames to the EBCS agent, which can evaluate whether the criteria used for relaying are met before relaying the HLP payload to the designated destination. This configuration, where the EBCS agent is not co-located with an EBCS AP, can be common in commercial deployments, such as in airports, train stations, shopping malls, or warehouses, where multiple EBCS APs may connect to a single entity (such as a network controller) on a public LAN that provides access to destinations outside the LAN. In such a configuration, the EBCS agent can reside on an entity within the LAN. On the other hand, this configuration can also be common in residential deployments, where the EBCS APs have direct connectivity to destinations outside the LAN.

[0126] As indicated above, Figure 5C This is provided as an example. Other examples may differ from the one provided. Figure 5C The example described.

[0127] Figure 6 This is a diagram illustrating an example process 600 performed by a device, for example, according to this disclosure. Example process 600 is an example in which a device (e.g., UE 120) performs operations associated with associating the device with an access point using credentials.

[0128] like Figure 6 As shown, in some aspects, process 600 may include transmitting a first frame (box 610) indicating device credentials and payload via broadcast. For example, the device (e.g., using communication manager 140 and / or Figure 9 The transmission component 904 depicted above can transmit the first frame of the instruction device credentials and payload via broadcast.

[0129] like Figure 6 As further shown, in some aspects, process 600 may include receiving a second frame (box 620) indicating a payload and access point credentials from the access point. For example, the device (e.g., using communication manager 140 and / or Figure 9 The receiving component 902 depicted herein can receive a second frame from the access point indicating the payload and access point credentials, as described above.

[0130] like Figure 6 As further shown, in some aspects, process 600 may include at least in part association with an access point based on access point credentials (box 630). For example, a device (e.g., using a communication manager 140 and / or Figure 9 The associated component 908 described above may be associated with an access point at least in part based on access point credentials, as described above.

[0131] like Figure 6 As further shown, in some aspects, process 600 may include, after the device has been associated with the access point, performing communication to the cloud computing device via the access point (box 640). For example, the device (e.g., using communication manager 140 and / or Figure 9 The receiving component 902 and / or transmitting component 904 described herein can perform communication to the cloud computing device via the access point after the device has been associated with the access point, as described above.

[0132] Process 600 may include additional aspects, such as any single aspect or any combination of aspects described below and / or in conjunction with one or more other processes described elsewhere herein.

[0133] In a first aspect, process 600 includes retrieving the access point credential from the second frame based at least in part on cloud computing system credentials, wherein the content of the second frame originates from the cloud computing system and is protected end-to-end.

[0134] In the second aspect, either alone or in combination with the first aspect, the content in the second frame is protected end-to-end using an asymmetric key.

[0135] In the third aspect, either alone or in combination with one or more of the first and second aspects, the device credential is signed by the cloud computing system; the payload includes one or more of a device identifier, a security credential associated with the device, or service-specific information; the first frame indicates a frame signature associated with and at least partially based on the device credential, and the first frame indicates a Uniform Resource Identifier associated with a destination, wherein the destination is associated with the cloud computing system.

[0136] In the fourth aspect, either alone or in combination with one or more of the first to third aspects, the device credential is a device certificate pre-configured when the device is manufactured or when a specific application is installed on the device; the payload is end-to-end protected using an asymmetric key between the device and the cloud computing system; and the security credential associated with the device in the payload is the device credential.

[0137] In the fifth aspect, either alone or in combination with one or more of the first to fourth aspects, the service-specific information indicates one or more of the following: the amount of data to be uploaded to the server, or the desired destination associated with the user, and additional information indicating the duration of the session or the amount of data permitted during the session is indicated from the cloud computing system to the access point at least in part based on the service-specific information.

[0138] In the sixth aspect, the first frame is transmitted, either alone or in combination with one or more of the first to fifth aspects, at least in part based on the satisfaction of a condition.

[0139] In the seventh aspect, the condition is satisfied at least in part based on the application being launched on the device, either alone or in combination with one or more of the first to sixth aspects.

[0140] In the eighth aspect, the condition is satisfied at least in part based on the device performing a task, either alone or in combination with one or more of the first to seventh aspects.

[0141] In the ninth aspect, the first frame is transmitted in a periodic manner, either alone or in combination with one or more of the first to eighth aspects.

[0142] In the tenth aspect, either alone or in combination with one or more of the first to ninth aspects, process 600 includes receiving the second frame via unicast transmission.

[0143] In the eleventh aspect, alone or in combination with one or more of the first to tenth aspects, process 600 includes receiving the second frame via broadcast transmission, wherein the second frame indicates a device identifier associated with the device and the access point credentials.

[0144] In the twelfth aspect, alone or in combination with one or more of the first to eleventh aspects, the second frame is a beacon frame broadcast from the access point.

[0145] In the thirteenth aspect, alone or in combination with one or more of the first to twelfth aspects, the device identifier is a media access control address associated with the device or a hash of the media access control address associated with the device.

[0146] In the fourteenth aspect, alone or in combination with one or more of the first to thirteenth aspects, process 600 includes verifying the payload and the access point credentials based at least in part on the cloud computing system credentials.

[0147] In the fifteenth aspect, alone or in combination with one or more of the first to fourteenth aspects, associating with the access point includes: transmitting an association request to the access point indicating the device credential; receiving an association response from the access point indicating the access point credential; and verifying the access point credential as indicated in the association response using the access point credential as indicated in the second frame.

[0148] In the sixteenth aspect, the access point is associated, either alone or in combination with one or more of the first to fifteenth aspects, at least in part, with public key-based authentication.

[0149] In the seventeenth aspect, alone or in combination with one or more of the first to sixteenth aspects, the access point credential is a temporary key that is added to the payload to enable the device to become associated with the access point.

[0150] In the eighteenth aspect, alone or in combination with one or more of the first to seventeenth aspects, process 600 includes receiving from the access point a list of addresses associated with the cloud computing system that the device can access, wherein the device cannot access addresses not indicated in the address list.

[0151] In the nineteenth aspect, alone or in combination with one or more of the first to eighteenth aspects, process 600 includes receiving an instruction from the access point that limits the payload size of communication with the cloud computing system or the number of requests allowed to be relayed from the access point to the cloud computing system on behalf of the device within a time period, wherein the payload size and the number of requests are based at least in part on a local policy at the access point or at least in part on the relationship between the access point and the cloud computing system.

[0152] In the twentieth aspect, alone or in combination with one or more of the first to nineteenth aspects, process 600 includes receiving an instruction from the access point that limits the duration of the association between the device and the access point, wherein the access point is configured to disconnect from the device after a specific time period based at least in part on the instruction from the cloud computing system.

[0153] In the twenty-first aspect, alone or in combination with one or more of the first to twentieth aspects, process 600 includes receiving an instruction from the access point that limits the amount or frequency of relayed payloads when the device is in a pre-association state, wherein the device is in the pre-association state prior to associating with the access point.

[0154] although Figure 6 An example box of process 600 is shown, but in some respects, process 600 may include... Figure 6 The boxes depicted in the process are compared to additional boxes, fewer boxes, different boxes, or boxes arranged differently. Additionally or alternatively, two or more boxes in process 600 can be executed in parallel.

[0155] Figure 7 This is a diagram illustrating an example process 700 performed by an access point, for example, according to this disclosure. Example process 700 is an example in which the access point performs operations associated with associating a device with the access point using credentials.

[0156] like Figure 7As shown, in some aspects, process 700 may include receiving a first frame from the device via broadcast, the first frame indicating device credentials and a payload (box 710). For example, an access point (e.g., using...) Figure 10 The receiving component 1002 described herein can receive a first frame from the device via broadcast, the first frame indicating device credentials and payload, as described above.

[0157] like Figure 7 As further shown, in some aspects, process 700 may include relaying the payload along with access point credentials to a cloud computing system (box 720). For example, the access point (e.g., using...) Figure 10 The transmission component 1004 described above can relay the payload along with the access point credentials to the cloud computing system.

[0158] like Figure 7 As further shown, in some aspects, process 700 may include receiving the payload and the access point credential from the cloud computing system based at least in part on the authentication of the payload and the access point credential (box 730). For example, the access point (e.g., using...) Figure 10 The receiving component 1002 described above may receive the payload and the access point credential from the cloud computing system based at least in part on the authentication of the payload and the access point credential, as described above.

[0159] like Figure 7 As further shown, in some aspects, process 700 may include associating the device with the access point credentials, at least in part, to enable communication between the device and the cloud computing system via the access point (box 740). For example, the access point (e.g., using...) Figure 10 The associated component 1008 described above may be associated with the device, at least in part, based on the access point credentials, to enable communication between the device and the cloud computing system via the access point, as described above.

[0160] Process 700 may include additional aspects, such as any single aspect or any combination of aspects described below and / or in conjunction with one or more other processes described elsewhere herein.

[0161] In the first aspect, one or more of the following are performed at an agent entity associated with the access point: evaluation criteria, maintaining or managing the relationship with the cloud computing system, adding additional information to the payload, or limiting the size of the payload relayed on behalf of the device. The agent entity is co-located with the access point or is located in a local area network associated with the access point.

[0162] In a second aspect, either alone or in conjunction with the first aspect, the link between the access point and the cloud computing system is protected using transport layer security or Internet Protocol security, wherein the link is protected using the access point or a proxy entity associated with the access point.

[0163] In the third aspect, alone or in combination with one or more of the first and second aspects, the content exchanged between the access point and the cloud computing system is protected by an asymmetric key between the access point and the cloud computing system.

[0164] In a fourth aspect, either alone or in combination with one or more of the first to third aspects, process 700 includes transmitting a second frame to the device, the second frame indicating the payload and the access point credentials.

[0165] In a fifth aspect, either alone or in combination with one or more of the first to fourth aspects, process 700 includes verifying the device credentials as indicated in the first frame based at least in part on cloud computing system credentials previously installed on the access point, wherein relaying the payload together with the access point credentials is based at least in part on verifying the device credentials.

[0166] In a sixth aspect, either alone or in combination with one or more of the first to fifth aspects, process 700 includes verifying, at least in part, that the device is authorized to transmit the payload to the cloud computing system based on the device credentials, wherein the device credentials are signed by the cloud computing system, and wherein the device is verified at least in part based on the cloud computing system credentials.

[0167] In the seventh aspect, either alone or in combination with one or more of the first to sixth aspects, process 700 includes discarding the first frame when the device credential subfield is present in the first frame and one or more of the following are true: the cloud computing system credential or the credential of the central authority that signed the device credential is not installed; verification of the device credential using the installed credential of the destination associated with the cloud computing system or the credential of the central authority fails; or the frame signature type subfield is not associated with higher-level authentication and verification of the frame signature associated with the first frame using the device credential fails.

[0168] In the eighth aspect, alone or in combination with one or more of the first to seventh aspects, process 700 includes discarding the first frame when a replay protection subfield is present in the first frame and one or more of the following are true: the time subfield is set to a non-zero value and the difference between the non-zero value and the time when the first frame was received satisfies a threshold; the frame count subfield is non-zero and less than or equal to the value in the previously received first frame; or the frame count subfield is zero and the value in the previously received first frame satisfies a threshold.

[0169] In the ninth aspect, alone or in combination with one or more of the first to eighth aspects, process 700 includes maintaining a sliding window of the frame count value to handle packet loss and the wrapping of the frame count subfield, wherein the frame count subfield wraps when an access point in the neighborhood has lost multiple frames including frames with a specific frame count.

[0170] In the tenth aspect, alone or in combination with one or more of the first to ninth aspects, the access point credential is a temporary key that is added to the payload to enable the device to become associated with the access point.

[0171] In the eleventh aspect, alone or in combination with one or more of the first to tenth aspects, process 700 includes ceasing to maintain state information associated with the device after the payload and the access point credentials are relayed to the cloud computing system.

[0172] In the twelfth aspect, associating the device, either alone or in combination with one or more of the first to eleventh aspects, includes: receiving an association request from the device indicating the device credentials; and transmitting an association response to the device indicating the access point credentials.

[0173] In the thirteenth aspect, an indication of the location associated with the device is added to the payload, either alone or in combination with one or more of the first to twelfth aspects, at least in part based on a protocol between the access point and the cloud computing system.

[0174] In the fourteenth aspect, alone or in combination with one or more of the first to thirteenth aspects, process 700 includes communicating with the cloud computing system via the proxy entity in the local area network when multiple access points in a region are connected to the cloud computing system via a proxy entity in the local area network that maintains a relationship with one or more cloud computing systems, wherein the proxy entity in the local area network includes a network controller.

[0175] In the fifteenth aspect, alone or in combination with one or more of the first to fourteenth aspects, the agent entity resides in a public entity included in a local area network, and one or more access points are connected to the public entity in the local area network where the agent entity resides.

[0176] In the sixteenth aspect, alone or in combination with one or more of the first to fifteenth aspects, process 700 includes transmitting to the device a list of addresses associated with the cloud computing system that the device can access, wherein the device cannot access addresses not indicated in the address list.

[0177] In the seventeenth aspect, alone or in combination with one or more of the first to sixteenth aspects, process 700 includes transmitting an instruction to the device that limits the payload size of communication between the device and the cloud computing system or the number of requests allowed to be relayed from the access point to the cloud computing system on behalf of the device within a time period, wherein the payload size and the number of requests are based at least in part on a local policy at the access point or at least in part on the relationship between the access point and the cloud computing system.

[0178] In the eighteenth aspect, alone or in combination with one or more of the first to seventeenth aspects, process 700 includes transmitting an instruction to a device that limits the duration of the association between the device and the access point, wherein the access point is configured to disconnect from the device after a specific period of time based at least in part on the instruction from the cloud computing system.

[0179] In the nineteenth aspect, alone or in combination with one or more of the first to eighteenth aspects, process 700 includes transmitting an instruction to the device that limits the amount or frequency of relayed payloads when the device is in a pre-association state, wherein the device is in the pre-association state before being associated with the access point.

[0180] In the twentieth aspect, the access point is co-located with an enhanced broadcast service agent, either alone or in combination with one or more of the first to nineteenth aspects.

[0181] although Figure 7 An example box of process 700 is shown, but in some respects, process 700 may include... Figure 7 The boxes depicted in the process are compared to additional boxes, fewer boxes, different boxes, or boxes arranged differently. Additionally or alternatively, two or more boxes in process 700 can be executed in parallel.

[0182] Figure 8 This is a diagram illustrating an example process 800 performed by, for example, a cloud computing system according to this disclosure. Example process 800 is an example in which the cloud computing system performs operations associated with associating a device with an access point using credentials.

[0183] like Figure 8 As shown, in some aspects, process 800 may include receiving an indication from an access point of a payload and access point credentials associated with the device (box 810). For example, a cloud computing system (e.g., using...) Figure 11 The receiving component 1102 described above can receive instructions from the access point regarding the payload and access point credentials associated with the device.

[0184] like Figure 8As further shown, in some aspects, process 800 may include verifying the payload and the access point credentials as specified in the instruction (box 820). For example, cloud computing systems (e.g., using...) Figure 11 The verification component 1108 described herein can verify the payload and the access point credentials as specified in the instruction, as described above.

[0185] like Figure 8 As further shown, in some aspects, process 800 may include transmitting the payload and the access point credentials to the access point at least in part based on the authentication of the payload and the access point credentials (box 830). For example, a cloud computing system (e.g., using...) Figure 11 The transmission component 1104 described above can transmit the payload and the access point credential to the access point at least in part based on the authentication of the payload and the access point credential, as described above.

[0186] like Figure 8 As further shown, in some aspects, process 800 may include communicating with the device via the access point at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials (box 840). For example, cloud computing systems (e.g., using...) Figure 11 The receiving component 1102 and / or the transmitting component 1104 described herein may communicate with the device via the access point at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials, as described above.

[0187] Process 800 may include additional aspects, such as any single aspect or any combination of aspects described below and / or in conjunction with one or more other processes described elsewhere herein.

[0188] In the first aspect, signaling between the cloud computing system and the access point occurs between the cloud computing system and an agent entity associated with the access point, wherein the agent entity is co-located with the access point or is located in a local area network associated with the access point.

[0189] Secondly, either alone or in combination with the first aspect, the link between the access point and the cloud computing system is protected using transport layer security or Internet Protocol security.

[0190] In the third aspect, alone or in combination with one or more of the first and second aspects, the content exchanged between the access point and the cloud computing system is protected by an asymmetric key between the access point and the cloud computing system.

[0191] In the fourth aspect, either alone or in combination with one or more of the first to third aspects, verifying the payload includes verifying the payload based at least in part on equipment credentials.

[0192] In the fifth aspect, either alone or in combination with one or more of the first to fourth aspects, process 800 includes verifying, at least in part, that the indication received from the access point originates from a trusted access point based on the access point credentials.

[0193] In the sixth aspect, the payload and the access point credentials transmitted to the access point, either alone or in combination with one or more of the first to fifth aspects, are intended for use with the device.

[0194] although Figure 8 An example box of process 800 is shown, but in some respects, process 800 may include... Figure 8 The boxes depicted in the process are compared to additional boxes, fewer boxes, different boxes, or boxes arranged differently. Additionally or alternatively, two or more boxes of process 800 can be executed in parallel.

[0195] Figure 9 This is a block diagram of an example device 900 for wireless communication. Device 900 may be a device, or a device may include device 900. In some aspects, device 900 includes a receiving component 902 and a transmitting component 904, which may be in communication with each other (e.g., via one or more buses and / or one or more other components). As shown, device 900 may use the receiving component 902 and the transmitting component 904 to communicate with another device 906 (such as a UE, a base station, or another wireless communication device). As further shown, device 900 may include a communication manager 140. Communication manager 140 may include an association component 908, etc.

[0196] In some respects, Equipment 900 can be configured to perform the combined functions described in this article. Figure 3 -5 describes one or more operations. Additionally or alternatively, equipment 900 may be configured to perform one or more processes described herein, such as Figure 6 The process is 600. In some respects, Figure 9 The equipment 900 and / or one or more components shown may include the above combination. Figure 2 One or more components of the described device. Additionally or alternatively, Figure 9 One or more components shown can be combined as described above. Figure 2Implementation within one or more of the described components. Additionally or alternatively, one or more components in the set of components may be implemented at least partially as software stored in memory. For example, a component (or a portion of a component) may be implemented as instructions or code stored in a non-transitory computer-readable medium and may be executed by a controller or processor to perform the function or operation of that component.

[0197] Receiver 902 can receive communications (such as reference signals, control information, data communications, or combinations thereof) from equipment 906. Receiver 902 can provide the received communications to one or more other components of equipment 900. In some aspects, receiver 902 can perform signal processing on the received communications (such as filtering, amplification, demodulation, analog-to-digital conversion, demultiplexing, deinterleaving, demapping, equalization, interference cancellation, or decoding, etc.), and can provide the processed signal to one or more other components of equipment 900. In some aspects, receiver 902 can include a combination of the above. Figure 2 The described device includes one or more antennas, demodulators, MIMO detectors, receiver processors, controllers / processors, memory, or combinations thereof.

[0198] The transmission component 904 can transmit communications (such as reference signals, control information, data communications, or combinations thereof) to the equipment 906. In some aspects, one or more other components of the equipment 900 can generate communications and provide the generated communications to the transmission component 904 for transmission to the equipment 906. In some aspects, the transmission component 904 can perform signal processing (such as filtering, amplification, modulation, digital-to-analog conversion, multiplexing, interleaving, mapping, encoding, etc.) on the generated communications and can transmit the processed signals to the equipment 906. In some aspects, the transmission component 904 can include combinations of the above. Figure 2 The described device includes one or more antennas, modulators, transmit MIMO processors, transmit processors, controllers / processors, memories, or combinations thereof. In some aspects, the transmit component 904 may be co-located with the receive component 902 in a transceiver.

[0199] Transmission component 904 may broadcast a first frame indicating device credentials and a payload. Receiving component 902 may receive a second frame indicating a payload and access point credentials from the access point. Association component 908 may associate with the access point at least in part based on the access point credentials. After the device has been associated with the access point, receiving component 902 and / or transmission component 904 may perform communication to the cloud computing device via the access point.

[0200] Figure 9 The number and arrangement of components shown are provided as an example. In practice, different arrangements may exist. Figure 9The components shown are compared to additional components, fewer components, different components, or components arranged differently. Furthermore, Figure 9 The two or more components shown can be implemented within a single component, or Figure 9 The single component shown can be implemented as multiple distributed components. Additionally or alternatively, Figure 9 The collection of components shown (e.g., one or more components) can be executed as described by Figure 9 The other set of components shown in the diagram performs one or more functions.

[0201] Figure 10 This is a block diagram of an example device 1000 for wireless communication. Device 1000 may be an access point, or an access point may include device 1000. In some aspects, device 1000 includes a receiving component 1002 and a transmitting component 1004, which may communicate with each other (e.g., via one or more buses and / or one or more other components). As shown, device 1000 may use the receiving component 1002 and the transmitting component 1004 to communicate with another device 1006 (such as a UE, a base station, or another wireless communication device). Device 1000 may include an association component 1008, etc.

[0202] In some respects, Equipment 1000 can be configured to perform the combined functions described in this article. Figure 3 -5 describes one or more operations. Additionally or alternatively, equipment 1000 may be configured to perform one or more processes described herein, such as Figure 7 The process is 700. In some respects, Figure 10 The equipment 1000 and / or one or more components shown may include the above combination. Figure 2 One or more components of the described access point. Additionally or alternatively, Figure 10 One or more components shown can be combined as described above. Figure 2 Implementation within one or more of the described components. Additionally or alternatively, one or more components in the set of components may be implemented at least partially as software stored in memory. For example, a component (or a portion of a component) may be implemented as instructions or code stored in a non-transitory computer-readable medium and may be executed by a controller or processor to perform the function or operation of that component.

[0203] Receiver 1002 may receive communications (such as reference signals, control information, data communications, or combinations thereof) from equipment 1006. Receiver 1002 may provide the received communications to one or more other components of equipment 1000. In some aspects, receiver 1002 may perform signal processing on the received communications (such as filtering, amplification, demodulation, analog-to-digital conversion, demultiplexing, deinterleaving, demapping, equalization, interference cancellation, or decoding, etc.), and may provide the processed signal to one or more other components of equipment 1000. In some aspects, receiver 1002 may include combinations of the above. Figure 2 The described access point includes one or more antennas, demodulators, MIMO detectors, receiver processors, controllers / processors, memory, or combinations thereof.

[0204] The transmission component 1004 can transmit communications (such as reference signals, control information, data communications, or combinations thereof) to the equipment 1006. In some aspects, one or more other components of the equipment 1000 can generate communications and provide the generated communications to the transmission component 1004 for transmission to the equipment 1006. In some aspects, the transmission component 1004 can perform signal processing (such as filtering, amplification, modulation, digital-to-analog conversion, multiplexing, interleaving, mapping, encoding, etc.) on the generated communications and can transmit the processed signals to the equipment 1006. In some aspects, the transmission component 1004 can include combinations of the above. Figure 2 The described access point includes one or more antennas, modulators, transmit MIMO processors, transmit processors, controllers / processors, memories, or combinations thereof. In some aspects, the transmit component 1004 may be co-located with the receive component 1002 in a transceiver.

[0205] The receiving component 1002 can receive a first frame from the device via broadcast, the first frame indicating device credentials and a payload. The transmitting component 1004 can relay the payload along with access point credentials to the cloud computing system. The receiving component 1002 can receive the payload and access point credentials from the cloud computing system based at least in part on the authentication of the payload and the access point credentials. The association component 1008 can associate with the device at least in part based on the access point credentials to enable communication between the device and the cloud computing system via the access point.

[0206] Figure 10 The number and arrangement of components shown are provided as an example. In practice, different arrangements may exist. Figure 10 The components shown are compared to additional components, fewer components, different components, or components arranged differently. Furthermore, Figure 10 The two or more components shown can be implemented within a single component, or Figure 10 The single component shown can be implemented as multiple distributed components. Additionally or alternatively, Figure 10 The collection of components shown (e.g., one or more components) can be executed as described by Figure 10 The other set of components shown in the diagram performs one or more functions.

[0207] Figure 11 This is a block diagram of an example device 1100 for wireless communication. Device 1100 may be a cloud computing system, or a cloud computing system may include device 1100. In some aspects, device 1100 includes a receiving component 1102 and a transmitting component 1104, which may communicate with each other (e.g., via one or more buses and / or one or more other components). As shown, device 1100 may use the receiving component 1102 and the transmitting component 1104 to communicate with another device 1106 (such as a UE, a base station, or another wireless communication device). As further shown, device 1100 may include an authentication component 1108, etc.

[0208] In some respects, Equipment 1100 can be configured to perform the combined functions described in this article. Figure 3 -5 describes one or more operations. Additionally or alternatively, equipment 1100 may be configured to perform one or more processes described herein, such as Figure 8 The process is 800. In some respects, it is equipped with 1100 and / or Figure 11 One or more components shown may include the above combination Figure 2 One or more components of the described cloud computing system. Additionally or alternatively, Figure 11 One or more components shown can be combined as described above. Figure 2 Implementation within one or more of the described components. Additionally or alternatively, one or more components in the set of components may be implemented at least partially as software stored in memory. For example, a component (or a portion of a component) may be implemented as instructions or code stored in a non-transitory computer-readable medium and may be executed by a controller or processor to perform the function or operation of that component.

[0209] Receiver 1102 may receive communications (such as reference signals, control information, data communications, or combinations thereof) from equipment 1106. Receiver 1102 may provide the received communications to one or more other components of equipment 1100. In some aspects, receiver 1102 may perform signal processing on the received communications (such as filtering, amplification, demodulation, analog-to-digital conversion, demultiplexing, deinterleaving, demapping, equalization, interference cancellation, or decoding, etc.), and may provide the processed signal to one or more other components of equipment 1100. In some aspects, receiver 1102 may include a combination of the above. Figure 2The cloud computing system described includes one or more antennas, demodulators, MIMO detectors, receiver processors, controllers / processors, memory, or combinations thereof.

[0210] Transmission component 1104 can transmit communications (such as reference signals, control information, data communications, or combinations thereof) to equipment 1106. In some aspects, one or more other components of equipment 1100 can generate communications and provide the generated communications to transmission component 1104 for transmission to equipment 1106. In some aspects, transmission component 1104 can perform signal processing (such as filtering, amplification, modulation, digital-to-analog conversion, multiplexing, interleaving, mapping, encoding, etc.) on the generated communications and can transmit the processed signals to equipment 1106. In some aspects, transmission component 1104 can include combinations of the above. Figure 2 The described cloud computing system includes one or more antennas, modulators, transmit MIMO processors, transmit processors, controllers / processors, memory, or combinations thereof. In some aspects, the transmit component 1104 may be co-located with the receive component 1102 in a transceiver.

[0211] Receiving component 1102 may receive from the access point an indication of a payload and access point credentials associated with the device. Authentication component 1108 may authenticate the payload and access point credentials as specified in the indication. Transmission component 1104 may transmit the payload and access point credentials to the access point, at least in part, based on the authentication of the payload and access point credentials. Receiving component 1102 and / or transmission component 1104 may communicate with the device via the access point, at least in part, based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials.

[0212] Figure 11 The number and arrangement of components shown are provided as an example. In practice, different arrangements may exist. Figure 11 The components shown are compared to additional components, fewer components, different components, or components arranged differently. Furthermore, Figure 11 The two or more components shown can be implemented within a single component, or Figure 11 The single component shown can be implemented as multiple distributed components. Additionally or alternatively, Figure 11 The collection of components shown (e.g., one or more components) can be executed as described by Figure 11 The other set of components shown in the diagram performs one or more functions.

[0213] The following provides an overview of some aspects of this disclosure:

[0214] Aspect 1: A wireless communication method performed by a device, comprising: transmitting a first frame via broadcast, the first frame indicating one or more of a device credential or a payload; receiving a second frame from an access point, the second frame indicating one or more of the payload or access point credential; associating the device with the access point at least in part based on the access point credential; and, after the device has been associated with the access point, performing communication to a cloud computing device via the access point.

[0215] Aspect 2: The method of aspect 1 further includes: retrieving the access point credential from the second frame based at least in part on cloud computing system credentials, wherein the content of the second frame originates from the cloud computing system and is protected end-to-end.

[0216] Aspect 3: The method of aspect 2, wherein the content in the second frame is protected end-to-end using an asymmetric key.

[0217] Aspect 4: A method of any of Aspects 1 to 3, wherein: the device credential is signed by the cloud computing system; the payload includes one or more of a device identifier, a security credential associated with the device, or service-specific information; the first frame indicates a frame signature associated with the first frame and derived at least in part based on the device credential; and the first frame indicates a Uniform Resource Identifier associated with a destination, wherein the destination is associated with the cloud computing system.

[0218] Aspect 5: The method of Aspect 4, wherein: the device credential is a device certificate pre-configured when the device is manufactured or when a specific application is installed on the device; the payload is end-to-end protected using an asymmetric key between the device and the cloud computing system; and the security credential associated with the device in the payload is the device credential.

[0219] Aspect 6: The method of Aspect 4, wherein the service-specific information indicates one or more of the following: the amount of data to be uploaded to the server, or the desired destination associated with the user, and wherein additional information indicating the duration of the session or the amount of data permitted during the session is indicated from the cloud computing system to the access point at least in part based on the service-specific information.

[0220] Aspect 7: The method of any of Aspects 1 to 6, wherein the transmission of the first frame is based at least in part on the satisfaction of a condition.

[0221] Aspect 8: The method of aspect 7, wherein the condition is satisfied at least in part based on launching the application on the device.

[0222] Aspect 9: The method of aspect 7, wherein the condition is satisfied at least in part based on the device performing a task.

[0223] Aspect 10: The method of any of Aspects 1 to 9, wherein the first frame is transmitted in a periodic manner.

[0224] Aspect 11: The method of any of Aspects 1 to 10, wherein receiving the second frame includes receiving the second frame via unicast transmission.

[0225] Aspect 12: The method of any of Aspects 1 to 11, wherein receiving the second frame includes receiving the second frame via broadcast transmission, wherein the second frame indicates a device identifier associated with the device and the access point credentials.

[0226] Aspect 13: The method of aspect 12, wherein the second frame is a beacon frame broadcast from the access point.

[0227] Aspect 14: The method of aspect 12, wherein the device identifier is a media access control address associated with the device or a hash of the media access control address associated with the device.

[0228] Aspect 15: The method of any of Aspects 1 to 14 further includes: verifying the payload and the access point credentials based at least in part on the cloud computing system credentials.

[0229] Aspect 16: A method of any of Aspects 1 to 15, wherein associating with the access point includes: transmitting an association request indicating the device credentials to the access point; receiving an association response indicating the access point credentials from the access point; and verifying the access point credentials as indicated in the association response using the access point credentials as indicated in the second frame.

[0230] Aspect 17: The method of any of Aspects 1 to 16, wherein the access point is associated with at least in part with public key-based authentication.

[0231] Aspect 18: The method of any of Aspects 1 to 17, wherein the access point credential is a temporary key, which is added to the payload to enable the device to become associated with the access point.

[0232] Aspect 19: The method of any of Aspects 1 to 18 further includes: receiving from the access point a list of addresses associated with the cloud computing system that the device can access, wherein the device cannot access addresses not indicated in the address list.

[0233] Aspect 20: The method of any of Aspects 1 to 19 further includes: receiving an instruction from the access point, the instruction limiting the payload size of communication with the cloud computing system or the number of requests allowed to be relayed from the access point to the cloud computing system on behalf of the device within a time period, wherein the payload size and the number of requests are based at least in part on a local policy at the access point or at least in part on a relationship between the access point and the cloud computing system.

[0234] Aspect 21: The method of any of Aspects 1 to 20 further includes: receiving an instruction from the access point, the instruction limiting the duration of the association between the device and the access point, wherein the access point is configured to disconnect from the device after a specific time period based at least in part on the instruction from the cloud computing system.

[0235] Aspect 22: The method of any of Aspects 1 to 21 further includes: receiving an instruction from the access point, the instruction limiting the amount or frequency of relayed payloads by the device when it is in a pre-association state, wherein the device is in the pre-association state before being associated with the access point.

[0236] Aspect 23: A wireless communication method performed by an access point, comprising: receiving a first frame from a device via broadcast, the first frame indicating device credentials and a payload; relaying the payload together with access point credentials to a cloud computing system; receiving the payload and the access point credentials from the cloud computing system at least in part based on authentication of the payload and the access point credentials; and associating the device with the access point at least in part based on the access point credentials to enable communication between the device and the cloud computing system via the access point.

[0237] Aspect 24: The method of aspect 23, wherein one or more of the following are performed at a proxy entity associated with the access point: evaluation criteria, maintaining or managing the relationship with the cloud computing system, adding additional information to the payload, or limiting the size of the payload relayed on behalf of the device. The proxy entity is co-located with the access point or is located in a local area network associated with the access point.

[0238] Aspect 25: The method of any of Aspects 23 to 24, wherein the link between the access point and the cloud computing system is protected using transport layer security or Internet Protocol security, wherein the link is protected using the access point or using a proxy entity associated with the access point.

[0239] Aspect 26: The method of any of Aspects 23 to 25, wherein the content exchanged between the access point and the cloud computing system is protected using an asymmetric key between the access point and the cloud computing system.

[0240] Aspect 27: The method of any of Aspects 23 to 26 further includes: transmitting a second frame to the device, the second frame indicating the payload and the access point credential.

[0241] Aspect 28: The method of any of Aspects 23 to 27 further includes: verifying the device credentials as indicated in the first frame based at least in part on cloud computing system credentials previously installed on the access point, wherein relaying the payload together with the access point credentials is based at least in part on verifying the device credentials.

[0242] Aspect 29: The method of any of Aspects 23 to 28 further includes: verifying, at least in part, that the device is authorized to transmit the payload to the cloud computing system based on the device credentials, wherein the device credentials are signed by the cloud computing system, and wherein the device is verified at least in part based on the cloud computing system credentials.

[0243] Aspect 30: The method of any of Aspects 23 to 29 further includes: discarding the first frame when the device credential subfield is present in the first frame and one or more of the following are true: the cloud computing system credential or the credential of the central authority that signed the device credential is not installed; verification of the device credential using the installed credential of the destination associated with the cloud computing system or the credential of the central authority fails; or the frame signature type subfield is not associated with higher-level authentication and verification of the frame signature associated with the first frame using the device credential fails.

[0244] Aspect 31: The method of any of Aspects 23 to 30 further includes: discarding the first frame when a replay protection subfield is present in the first frame and one or more of the following are true: a time subfield is set to a non-zero value and the difference between the non-zero value and the time of receiving the first frame satisfies a threshold, a frame count subfield is non-zero and less than or equal to a value in a previously received first frame, or the frame count subfield is zero and the value in the previously received first frame satisfies a threshold.

[0245] Aspect 32: The method of any of Aspects 23 to 31 further includes: maintaining a sliding window of the frame count value to handle packet loss and the wrapping of the frame count subfield, wherein the frame count subfield wraps when an access point in the neighborhood has lost multiple frames including frames with a specific frame count.

[0246] Aspect 33: The method of any of Aspects 23 to 26, wherein the access point credential is a temporary key, which is added to the payload to enable the device to become associated with the access point.

[0247] Aspect 34: The method of any of Aspects 23 to 33 further includes: ceasing to maintain state information associated with the device after the payload and the access point credentials are relayed to the cloud computing system.

[0248] Aspect 35: The method of any of Aspects 23 to 34, wherein associating with the device includes: receiving an association request from the device indicating the device credentials; and transmitting an association response to the device indicating the access point credentials.

[0249] Aspect 36: The method of any of Aspects 23 to 35, wherein the indication of the location associated with the device is added to the payload based at least in part on a protocol between the access point and the cloud computing system.

[0250] Aspect 37: The method of any of Aspects 23 to 36 further includes: communicating with the cloud computing system via the proxy entity in the local area network when multiple access points in a region are connected to the cloud computing system via a proxy entity in the local area network that maintains a relationship with one or more cloud computing systems, wherein the proxy entity in the local area network includes a network controller.

[0251] Aspect 38: The method of aspect 37, wherein the agent entity resides in a public entity included in a local area network, and one or more access points are connected to the public entity in the local area network where the agent entity resides.

[0252] Aspect 39: The method of any of Aspects 23 to 38 further includes: transmitting to the device a list of addresses associated with the cloud computing system that the device can access, wherein the device cannot access addresses not indicated in the address list.

[0253] Aspect 40: The method of any of Aspects 23 to 39 further includes: transmitting an instruction to the device, the instruction limiting the payload size of communication between the device and the cloud computing system or the number of requests allowed to be relayed from the access point to the cloud computing system on behalf of the device within a time period, wherein the payload size and the number of requests are based at least in part on a local policy at the access point or at least in part on a relationship between the access point and the cloud computing system.

[0254] Aspect 41: The method of any of Aspects 23 to 40 further includes: transmitting an instruction to a device, the instruction limiting the duration of the association between the device and the access point, wherein the access point is configured to disconnect from the device after a specific time period based at least in part on the instruction from the cloud computing system.

[0255] Aspect 42: The method of any of Aspects 23 to 41 further includes: transmitting an instruction to the device, the instruction limiting the amount or frequency of relayed payloads by the device when it is in a pre-association state, wherein the device is in the pre-association state before being associated with the access point.

[0256] Aspect 43: The method of any of Aspects 23 to 42, wherein the access point is co-located with the enhanced broadcast service agent.

[0257] Aspect 44: A wireless communication method performed by a cloud computing system, comprising: receiving from an access point an indication of a payload and access point credentials associated with a device; verifying the payload and access point credentials as specified in the indication; transmitting the payload and access point credentials to the access point at least in part based on the verification of the payload and access point credentials; and communicating with the device via the access point at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials.

[0258] Aspect 45: The method of aspect 44, wherein signaling between the cloud computing system and the access point is performed between the cloud computing system and an agent entity associated with the access point, wherein the agent entity is co-located with the access point or the agent entity is located in a local area network associated with the access point;

[0259] Aspect 46: The method of any of Aspects 44 to 45, wherein the link between the access point and the cloud computing system is protected using transport layer security or Internet Protocol security.

[0260] Aspect 47: The method of any of Aspects 44 to 46, wherein the content exchanged between the access point and the cloud computing system is protected using an asymmetric key between the access point and the cloud computing system.

[0261] Aspect 48: The method of any of Aspects 44 to 47, wherein verifying the payload includes verifying the payload based at least in part on device credentials.

[0262] Aspect 49: The method of any of Aspects 44 to 48 further includes: verifying, at least in part, that the indication received from the access point originates from a trusted access point based on the access point credentials.

[0263] Aspect 50: The method of any of Aspects 44 to 49, wherein the payload and the access point credentials transmitted to the access point are intended for use with the device.

[0264] Aspect 51: An apparatus for wireless communication at a device, comprising: a processor; a memory coupled to the processor; and instructions stored in the memory, the instructions being executable by the processor to cause the apparatus to perform one or more of the methods of aspects 1-22.

[0265] Aspect 52: An apparatus for wireless communication, comprising a memory and one or more processors coupled to the memory, the one or more processors being configured to perform methods as described in one or more aspects of aspects 1-22.

[0266] Aspect 53: An apparatus for wireless communication, comprising at least one means for performing one or more methods as described in aspects 1-22.

[0267] Aspect 54: A non-transient computer-readable medium storing code for wireless communication, the code including instructions executable by a processor to perform one or more of the methods of aspects 1-22.

[0268] Aspect 55: A non-transient computer-readable medium storing a set of instructions for wireless communication, the set of instructions including one or more instructions which, when executed by one or more processors of a device, cause the device to perform one or more of the methods of aspects 1-22.

[0269] Aspect 56: An apparatus for wireless communication at a device, comprising: a processor; a memory coupled to the processor; and instructions stored in the memory, the instructions being executable by the processor to cause the apparatus to perform one or more of the methods of aspects 23-43.

[0270] Aspect 57: An apparatus for wireless communication, comprising a memory and one or more processors coupled to the memory, the one or more processors being configured to perform methods as described in one or more aspects of aspects 23-43.

[0271] Aspect 58: An apparatus for wireless communication, comprising at least one means for performing one or more methods as described in aspects 23-43.

[0272] Aspect 59: A non-transient computer-readable medium storing code for wireless communication, the code including instructions executable by a processor to perform one or more methods as described in aspects 23-43.

[0273] Aspect 60: A non-transient computer-readable medium storing a set of instructions for wireless communication, the set of instructions including one or more instructions which, when executed by one or more processors of a device, cause the device to perform one or more methods as described in aspects 23-43.

[0274] Aspect 61: An apparatus for wireless communication at a device, comprising: a processor; a memory coupled to the processor; and instructions stored in the memory, the instructions being executable by the processor to cause the apparatus to perform one or more of the methods of aspects 44-50.

[0275] Aspect 62: An apparatus for wireless communication, comprising a memory and one or more processors coupled to the memory, the one or more processors being configured to perform methods as described in one or more aspects of aspects 44-50.

[0276] Aspect 63: An apparatus for wireless communication, comprising at least one means for performing one or more methods as described in aspects 44-50.

[0277] Aspect 64: A non-transient computer-readable medium storing code for wireless communication, the code including instructions executable by a processor to perform one or more methods as described in aspects 44-50.

[0278] Aspect 65: A non-transient computer-readable medium storing a set of instructions for wireless communication, the set of instructions including one or more instructions which, when executed by one or more processors of a device, cause the device to perform one or more methods as described in aspects 44-50.

[0279] The foregoing disclosure provides explanations and descriptions, but is not intended to be exhaustive or to limit the aspects to the precise forms disclosed. Modifications and variations may be made in light of the foregoing disclosure or may be obtained through practice.

[0280] As used herein, the term "component" is intended to be broadly interpreted as hardware and / or a combination of hardware and software. "Software" should be broadly interpreted as instructions, instruction sets, code, code segments, program code, programs, subroutines, software modules, applications, software applications, software packages, routines, subroutines, objects, executables, threads of execution, procedures, and / or functions, whether referred to as software, firmware, middleware, microcode, hardware description languages, or other terms. As used herein, a "processor" is implemented in hardware and / or a combination of hardware and software. It will be apparent that the systems and / or methods described herein can be implemented in various forms of hardware and / or combinations of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods is not limited in any way. Therefore, the operation and behavior of these systems and / or methods are described herein without reference to any specific software code, as those skilled in the art will understand that software and hardware can be designed to implement these systems and / or methods, at least in part, based on the description herein.

[0281] As used in this article, depending on the context, "meeting the threshold" can mean a value greater than the threshold, greater than or equal to the threshold, less than the threshold, less than or equal to the threshold, equal to the threshold, not equal to the threshold, etc.

[0282] Although specific combinations of features are described in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of aspects. Many of these features may be combined in ways not specifically described in the claims and / or disclosed in the specification. The disclosure of aspects includes each dependent claim in combination with each other claim in the claim set. As used herein, the phrase “at least one of” refers to any combination of these items, including a single member. As an example, “at least one of a, b, or c” is intended to cover: a, b, c, a+b, a+c, b+c, and a+b+c, as well as any combination having multiple identical elements (e.g., a+a, a+a+a, a+a+b, a+a+c, a+b+b, a+c+c, b+b, b+b+b, b+b+c, c+c, and c+c+c, or any other ordering of a, b, and c).

[0283] The elements, actions, or instructions used herein should not be construed as essential or necessary unless explicitly stated otherwise. Furthermore, as used herein, the articles “a” and “a certain” are intended to include one or more items and may be used interchangeably with “one or more.” Additionally, as used herein, the article “the” is intended to include one or more items referenced in conjunction with the article “the” and may be used interchangeably with “one or more.” Furthermore, as used herein, the terms “set” and “group” are intended to include one or more items and may be used interchangeably with “one or more.” In cases where only one item is intended, the phrase “only one” or similar language is used. Moreover, as used herein, the terms “have,” “contain,” “include,” etc., are intended to be open-ended terms that do not limit the elements they modify (e.g., the element “has” A may also have B). Furthermore, the phrase “based on” is intended to mean “at least partially based on” unless otherwise explicitly stated. Moreover, as used herein, the term “or” is intended to be inclusive when used in a sequence and may be used interchangeably with “and / or” unless otherwise explicitly stated (e.g., in combination with “either of” or “only one of”).

Claims

1. An apparatus for wireless communication, comprising: Memory; as well as One or more processors are coupled to the memory and configured to: The first frame is transmitted via broadcast, and the first frame indicates one or more of the device credentials or payload; Receive a second frame from the access point, the second frame indicating one or more of the payload or access point credentials; The access point credentials are retrieved from the second frame based at least in part on cloud computing system credentials, wherein the content of the second frame originates from the cloud computing system and is end-to-end protected, and wherein the content of the second frame is end-to-end protected using an asymmetric key. At least in part, the access point is associated with the access point based on the access point credentials; as well as After the device has been associated with the access point, communication to the cloud computing system is performed via the access point.

2. The equipment as described in claim 1, wherein: The device credential is signed by the cloud computing system; The payload includes one or more of the following: a device identifier, security credentials associated with the device, or service-specific information; and The first frame indicates one or more of the following: a frame signature associated with the first frame and derived at least in part based on the device credentials, or a Uniform Resource Identifier associated with a destination, wherein the destination is associated with the cloud computing system.

3. The equipment as described in claim 2, wherein: The device certificate is a device certificate pre-assigned when the device is manufactured or when a specific application is installed on the device. The payload is end-to-end protected using an asymmetric key between the device and the cloud computing system; The security credentials associated with the device in the payload are the device credentials; and The service-specific information indicates one or more of the following: the amount of data to be uploaded to the server, or the desired destination associated with the user, and wherein additional information indicating the duration of the session or the amount of data permitted during the session is indicated from the cloud computing system to the access point at least in part based on the service-specific information.

4. The apparatus of claim 1, wherein the one or more processors are configured to transmit the first frame at least in part based on a condition being met, wherein the condition is met at least in part based on an application being launched on the device, and wherein the condition is met at least in part based on the device performing a task.

5. The apparatus of claim 1, wherein the one or more processors are configured to transmit the first frame in a periodic manner.

6. The apparatus of claim 1, wherein the one or more processors are configured to: The second frame is received via unicast transmission; or The second frame is received via broadcast transmission, wherein the second frame indicates a device identifier associated with the device and the access point credentials.

7. The equipment as claimed in claim 6, wherein: The second frame is a beacon frame broadcast from the access point; and The device identifier is a media access control address associated with the device or a hash of the media access control address associated with the device.

8. The apparatus of claim 1, wherein the one or more processors are configured to verify the payload and the access point credentials at least in part based on the cloud computing system credentials.

9. The apparatus of claim 1, wherein, in order to be associated with the access point, the one or more processors are configured to: Send an association request indicating the device credentials to the access point; Receive an associated response from the access point indicating the access point credentials; and Use the access point credentials as indicated in the second frame to verify the access point credentials as indicated in the associated response.

10. The apparatus of claim 1, wherein the one or more processors are configured to associate with the access point at least in part based on public key-based authentication.

11. The apparatus of claim 1, wherein the access point credential is a temporary key, the temporary key being added to the payload to enable the apparatus to become associated with the access point.

12. The apparatus of claim 1, wherein the one or more processors are configured to receive from the access point a list of addresses associated with the cloud computing system that the device can access, wherein the device cannot access addresses not indicated in the address list.

13. The apparatus of claim 1, wherein the one or more processors are configured to receive instructions from the access point, the instructions limiting the payload size of communication with the cloud computing system or the number of requests permitted to be relayed from the access point to the cloud computing system on behalf of the device within a time period, wherein the payload size and the number of requests are based at least in part on a local policy at the access point or at least in part on a relationship between the access point and the cloud computing system.

14. The apparatus of claim 1, wherein the one or more processors are configured to receive instructions from the access point, the instructions limiting the duration of the association between the device and the access point, wherein the access point is configured to disconnect from the device after a specific time period, at least in part based on the instructions from the cloud computing system.

15. The apparatus of claim 1, wherein the one or more processors are configured to receive instructions from the access point, the instructions limiting the amount or frequency of payload relayed by the device in a pre-association state, wherein the device is in the pre-association state prior to associating with the access point.

16. An apparatus for wireless communication at an access point, comprising: Memory; as well as One or more processors are coupled to the memory and configured to: The first frame is received from the device via broadcast; the first frame indicates the device credentials and payload. The payload, along with the access point credentials, is relayed to the cloud computing system. The payload and the access point credentials are received from the cloud computing system based at least in part on the verification of the payload and the access point credentials; A second frame is transmitted to the device, the second frame indicating the payload and the access point credentials, wherein the content of the second frame originates from the cloud computing system and is end-to-end protected, and wherein the content of the second frame is end-to-end protected using an asymmetric key; as well as The device is associated with at least in part based on the access point credentials to enable communication between the device and the cloud computing system via the access point.

17. The equipment as claimed in claim 16, wherein: One or more of the following are performed at a proxy entity associated with the access point: evaluation criteria, maintaining or managing the relationship with the cloud computing system, adding additional information to the payload, or limiting the size of the payload relayed on behalf of the device; wherein the proxy entity is co-located with the access point or the proxy entity is located in a local area network associated with the access point. The link between the access point and the cloud computing system is protected using transport layer security or Internet Protocol security, wherein the link is protected using the access point or the proxy entity associated with the access point; or The content exchanged between the access point and the cloud computing system is protected using an asymmetric key between the access point and the cloud computing system.

18. The apparatus of claim 16, wherein the one or more processors are configured to verify the device credentials as indicated in the first frame, at least in part, based on cloud computing system credentials previously installed on the access point, wherein relaying the payload together with the access point credentials is at least in part based on verifying the device credentials.

19. The apparatus of claim 16, wherein the one or more processors are configured to: The device is authorized to transmit the payload to the cloud computing system based at least in part on the device credentials, wherein the device credentials are signed by the cloud computing system, and wherein the device is verified at least in part based on the cloud computing system credentials. The first frame is discarded if the device credential subfield is present in the first frame and one or more of the following are true: the cloud computing system credential or the credential of the central authority that signed the device credential is not installed; verification of the device credential using an installed credential of the destination associated with the cloud computing system or the credential of the central authority fails; or the frame signature type subfield is not associated with higher-level authentication and verification of the frame signature associated with the first frame using the device credential fails; or The first frame is discarded when the replay protection subfield is present in the first frame and one or more of the following conditions are met: the time subfield is set to a non-zero value and the difference between the non-zero value and the time when the first frame was received satisfies a threshold; the frame count subfield is non-zero and less than or equal to the value in the previously received first frame; or the frame count subfield is zero and the value in the previously received first frame satisfies a threshold.

20. The apparatus of claim 16, wherein the one or more processors are configured to: A sliding window maintains the frame count value to handle packet loss and the wrapping of the frame count subfield, wherein the frame count subfield wraps when an access point in the neighborhood has lost multiple frames, including frames with a specific frame count. After the payload and the access point credentials are relayed to the cloud computing system, the maintenance of the state information associated with the device is stopped; or When multiple access points in a region are connected to the cloud computing system via a proxy entity in a local area network (LAN) that maintains a relationship with one or more cloud computing systems, they communicate with the cloud computing system via the proxy entity in the LAN, wherein the proxy entity in the LAN includes a network controller, wherein the proxy entity resides in a common entity included in the LAN, and wherein one or more access points are connected to the common entity in the LAN where the proxy entity resides.

21. The equipment as claimed in claim 16, wherein: The access point credential is a temporary key, which is added to the payload to enable the device to become associated with the access point; or The indication of the location associated with the device is added to the payload based at least in part on a protocol between the access point and the cloud computing system.

22. The apparatus of claim 16, wherein, in order to be associated with the apparatus, the one or more processors are configured to: Receive an association request indicating the device credentials from the device; and Send an associated response indicating the access point credentials to the device.

23. The apparatus of claim 16, wherein the one or more processors are configured to: Transmit to the device a list of addresses associated with the cloud computing system that the device can access, wherein the device cannot access addresses not indicated in the address list; or The device is instructed to limit the payload size of communication between the device and the cloud computing system or the number of requests allowed to be relayed from the access point to the cloud computing system on behalf of the device within a time period, wherein the payload size and the number of requests are based at least in part on a local policy at the access point or at least in part on the relationship between the access point and the cloud computing system.

24. The apparatus of claim 16, wherein the one or more processors are configured to: Send an instruction to the device that limits the duration of the association between the device and the access point, wherein the access point is configured to disconnect from the device after a specific period of time, at least in part based on the instruction from the cloud computing system; or A command is transmitted to the device, the command limiting the amount or frequency of the relayed payload when the device is in a pre-association state, wherein the device is in the pre-association state before being associated with the access point.

25. The apparatus of claim 16, wherein the access point is co-located with the enhanced broadcast service agent.

26. An apparatus for wireless communication in a cloud computing system, comprising: Memory; as well as One or more processors are coupled to the memory and configured to: Receive instructions from the access point regarding the payload and access point credentials associated with the device; Verify the payload and access point credentials as specified in the instructions; The payload and the access point credentials are transmitted to the access point at least in part based on the authentication of the payload and the access point credentials, wherein the payload and the access point credentials are end-to-end protected between the cloud computing system and the device using an asymmetric key; as well as The device communicates with the access point via the access point, at least in part based on an association between the device and the access point, wherein the association is at least in part based on the access point credentials.

27. The equipment as claimed in claim 26, wherein: The signaling between the cloud computing system and the access point is performed between the cloud computing system and the proxy entity associated with the access point, wherein the proxy entity is co-located with the access point or the proxy entity is located in a local area network associated with the access point; The link between the access point and the cloud computing system is protected using transport layer security or Internet Protocol security. The content exchanged between the access point and the cloud computing system is protected using an asymmetric key between the access point and the cloud computing system; or The payload and the access point credentials transmitted to the access point are intended for use with the device.

28. The apparatus of claim 26, wherein the one or more processors are configured to validate the payload at least in part based on device credentials.

29. The apparatus of claim 26, wherein the one or more processors are configured to verify, at least in part, that the indication received from the access point originates from a trusted access point based on the access point credentials.

Images