Data frame encryption method and device, equipment and storage medium

Abstract

The embodiment of the invention relates to the technical field of communication, provides a data frame encryption method and device, equipment and a storage medium, and can be applied to first equipment. The method comprises: determining a first wireless frame, the first wireless frame comprising a first identification bit, the first identification bit being used for indicating that a first device supports construction of a new AAD; and sending the first wireless frame. The embodiment of the invention can be used for the first equipment to indicate that the first equipment supports the construction of the new AAD to other equipment.

Description

Data frame encryption method, device, equipment and storage medium Technical Field

[0001] The embodiments of the present disclosure relate to the field of communication technology. Specifically, the embodiments of the present disclosure relate to a data frame encryption method, apparatus, device, and storage medium. Background Art

[0002] With the continuous development of Wireless Fidelity (Wi-Fi) technology, researchers have proposed the next generation of Wi-Fi technology: Ultra High Reliability (UHR), with the vision of improving the reliability of WLAN connections, reducing latency, increasing manageability, and increasing throughput.

[0003] To ensure the reliability of data frame transmission, existing technologies generally construct additional authentication data (AAD) to further encrypt the data frames to be transmitted, thereby ensuring the security of the data frames to be transmitted. However, existing AAD construction methods can only ensure the security of a limited amount of data in the data frames to be transmitted, and the data reliability is poor.

[0004] Summary of the Invention

[0005] The embodiments of the present disclosure provide a data frame encryption method, apparatus, device, and storage medium, which can be used to indicate the construction method of AAD to other devices.

[0006] In a first aspect, an embodiment of the present disclosure provides a data frame encryption method, which can be applied to a first device. The method includes:

[0007] Determine a first radio frame, where the first radio frame includes a first identification bit, and the first identification bit is used to indicate that the first device supports construction of new additional authentication data AAD;

[0008] Send the first wireless frame.

[0009] In a second aspect, an embodiment of the present disclosure further provides a data frame encryption device, the device comprising:

[0010] a determining unit, configured to determine a first radio frame, where the first radio frame includes a first identification bit, and the first identification bit is used to indicate that the first device supports construction of new additional authentication data AAD;

[0011] A communication unit is configured to send the first wireless frame.

[0012] In a third aspect, an embodiment of the present disclosure further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements any one of the data frame encryption methods provided in the embodiment of the present disclosure.

[0013] In a fourth aspect, embodiments of the present disclosure further provide a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program implements any one of the data frame encryption methods provided in embodiments of the present disclosure.

[0014] Additional aspects and advantages of the embodiments of the present disclosure will be given in part in the following description, which will become apparent from the following description or be learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the description of the embodiments of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0016] Figure 1 is an existing data frame encryption method;

[0017] FIG2 is a schematic structural diagram of a communication system provided by an embodiment of the present disclosure;

[0018] FIG3 is an interactive diagram of a data frame encryption method provided by an embodiment of the present disclosure;

[0019] FIG4 is a flow chart of a data frame encryption method provided by an embodiment of the present disclosure;

[0020] FIG5 is a schematic structural diagram of a data frame encryption device provided by an embodiment of the present disclosure;

[0021] FIG6 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0022] In the embodiments of the present disclosure, the term "and / or" describes the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0023] In the embodiments of the present disclosure, the term "plurality" refers to two or more than two, and other quantifiers are similar thereto.

[0024] Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. In the following description, unless otherwise indicated, like numbers in different figures represent like or similar elements. The embodiments described in the following exemplary embodiments are not intended to represent all possible embodiments consistent with the present invention. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present invention, as detailed in the appended claims.

[0025] The terms used in this disclosure are for the purpose of describing specific embodiments only and are not intended to limit the disclosure. As used in this disclosure and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0026] It should be understood that although the terms first, second, third, etc. may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, for example, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining."

[0027] In existing WLAN technologies, the encryption process of data frames is shown in Figure 1:

[0028] For each newly transmitted plaintext Media Access Control Protocol Data Unit (MPDU), when encrypting it, the Additional Authentication Data (AAD) is constructed based on the plaintext MPDU's MAC header. A nonce is constructed based on the packet number (PN), the plaintext MPDU's Address 2 (A2), and the priority field in the Quality of Service (QoS) field. The Temporal Key (TK), the MPDU's data, the nonce, and the AAD are encrypted using CCM encryption to produce the encrypted data and a Message Integrity Check (MIC). A Counter Mode with CBC-MAC Protocol (CCMP) header is constructed based on the PN and the encryption key identifier (Key ID). The MAC header, CCMP header, encrypted data, and the MIC are assembled to produce the encrypted MPDU.

[0029] The PN is incremented, that is, each newly transmitted MPDU will generate a new PN, and if it is a retransmitted MPDU, the old PN will be used.

[0030] The existing AAD architecture can be shown as follows:

[0031] Among them, FC, A1, A2, A3, SC, A4, and QC correspond to the frame control field (Frame Control), Address1, Address2, Address3, sequence control field (Sequence Control, SC), and quality of service control field (QoS Control) in the MAC header of the plaintext MPDU, respectively.

[0032] And when any one or more of QC and A4 are present or absent, the length of AAD is as follows:

[0033] The structure of the MAC frame is as follows:

[0034] The fields other than the Frame Body and the Frame Check Sequence (FCS) constitute the MAC header.

[0035] The format of the Frame Control field is as follows:

[0036] The Frame Control field includes the Protocol Version field, the Type field, the Subtype field, the Distribution System (DS) field, the From DS field, the More Fragments field, the Retry field, the Power Management field, the More Data field, the Protected Frame field, and the High Throughput Indication (+HTC) field.

[0037] Among them, when constructing AAD, the three least significant bits (LSB) of the Subtype field in FC (bits 4, 5, and 6 in FC) are masked, and bit 7 in FC is not modified;

[0038] The Retry field (bit 11 in FC) is masked;

[0039] The Power Management field (bit 12 in FC) is masked;

[0040] The More Data field (bit 13 in FC) is masked;

[0041] The Protected Frame field (bit 14 in FC) is not modified;

[0042] When the MPDU frame includes the QoS Control field, the +HTC field is masked, and in other cases it is not modified;

[0043] Other fields in the FC remain unchanged.

[0044] Among them, when constructing AAD, A1, A2, A3 and A4 in the MAC header are not modified;

[0045] The Sequence Number field in the Sequence Control field is masked, and the Fragment Number field is not modified.

[0046] If the QoS field includes the MSDU priority, the QC TID is used to construct the AAD. In a non-DMG BSS, if the SPP a-MSDU Capabilities subfields of the STA and its peer are equal, the A-MSDU Present field is also used to construct the AAD. In a DMG BSS, the A-MSDU Present field and A-MSDU Type field are also used in the construction of the AAD.

[0047] As described above regarding AAD construction, the HT control field in the MAC header does not participate in AAD construction. However, the HT control field contains sensitive information, such as the Buffer Status Report (BSR). If exploited by an attacker, this information could lead to resource coordination issues and hinder efficient spectrum utilization. Therefore, a new AAD construction method is needed to reduce data frame transmission risks.

[0048] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure and not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0049] Among them, the method and the device are based on the same public concept. Since the principles of solving problems by the method and the device are similar, the implementation of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0050] 2 is a schematic diagram of the structure of a communication system provided by an embodiment of the present disclosure. The system architecture includes an AP device and a STA device. After establishing an association with the STA device, the AP device can perform data transmission with the STA device.

[0051] The AP device in the embodiment of the present disclosure may be an independent device not attached to any AP MLD, or an attached AP device of an AP MLD, or the AP MLD may be regarded as the AP device in the embodiment of the present disclosure, which is not limited here.

[0052] The STA device may be an independent device not attached to any Non-AP MLD, or an attached STA device of the Non-AP MLD, or the Non-AP MLD may be regarded as a STA device in the embodiment of the present disclosure, which is not limited here.

[0053] Among them, for an AP device or a STA device (referred to as the first device in the embodiment of this disclosure), it can determine and send a first wireless frame to the other party, and the first wireless frame includes a first identification bit, which is used to indicate that the first device supports the newly constructed AAD.

[0054] The new AAD includes parameter information of the high throughput control (HT Control) field in the frame control field.

[0055] Furthermore, the first device may construct a first AAD for encrypting the first MPDU frame based on the new construction, and construct an encrypted MPDU frame according to the first AAD, thereby sending the encrypted MPDU frame to the second device.

[0056] The data frame encryption method provided by the embodiment of the present disclosure is further described below with reference to FIG3 .

[0057] For the first device, the first device may determine and send a first wireless frame to the second device, where the first wireless frame includes a first identification bit, and the first identification bit is used to indicate that the first device supports the construction of new additional authentication data AAD.

[0058] When the first device is an AP device, the second device is a STA device; when the first device is a STA device, the second device is an AP device.

[0059] When the first device needs to send the first MPDU frame, it can construct a new AAD corresponding to the first MPDU frame, and further construct an encrypted MPDU frame based on the constructed new AAD and the first MPDU frame.

[0060] Among them, when constructing a new AAD, at least one of the high throughput control field in the MAC header of the first MPDU frame, the duration field in the MAC header, the sequence number field of the sequence control field in the MAC header, the more fragments field in the frame control field, the retransmission field in the frame control field, the power management field in the frame control field, the more data field in the frame control field, and the high throughput control indication field in the frame control field participates in the construction of the new AAD.

[0061] After the first device completes construction of the encrypted MPDU frame, the first device may send the encrypted MPDU frame to the second device.

[0062] Among them, the encrypted MPDU frame includes a first indication field (the protocol version field in the frame control field in the MAC header), which is used to indicate that the encrypted MPDU frame is constructed based on the new AAD, and further instructs the second device to adopt a corresponding decryption method to parse the encrypted MPDU frame.

[0063] The present disclosure provides a data frame encryption method that can be applied to a first device. Specifically, see FIG4 , which is a flow chart of the data frame encryption method provided by the present disclosure.

[0064] Optionally, the data frame encryption method applied to the first device provided in the embodiment of the present disclosure may include the following steps:

[0065] Step S41: Determine a first wireless frame, where the first wireless frame includes a first identification bit, and the first identification bit is used to indicate that the first device supports the construction of a new AAD.

[0066] Among them, compared with the AAD constructed by the existing technology, the new AAD also includes parameter information of at least one information field that is blocked or not adopted by the existing technology, such as the parameter information of the More fragments field in the Frame Control field, the Retry field, the Power Management field, the More Data field, the High Throughput Control Indication (+HTC) field, the High Throughput Control (HT Control) field in the MAC header, the Duration field and other information fields.

[0067] Step S42: Send a first wireless frame.

[0068] Among them, the first device in the embodiment of the present disclosure can be an AP device or a STA device. When the first device is an AP device, the first device can send a first wireless frame to the STA device. When the first device is a STA device, the first device can send a first wireless frame to the AP device.

[0069] In the data frame encryption method applied to the first device provided in the embodiment of the present disclosure, the first wireless frame includes an extended robust security network (RSN) capabilities (Extended RSN capabilities) field, and the Extended RSN capabilities field includes a first identification bit.

[0070] The first radio frame includes a Robust Security Network Extension (RSNXE) element, the RSNEX element includes an Extended RSN capabilities field, and the Extended RSN capabilities field includes a first identification bit.

[0071] The format of the RSNEX element may be as follows:

[0072] The Extended RSN capabilities field includes multiple bits. Bits 0-3 correspond to the Field length field, which is used to indicate the length of the Extended RSN capabilities field. The 4th bit corresponds to the Protected TWT Operations Support field. When dot11ProtectedTWTOoperationslmlemented is true, the STA device sets the value of the 4th bit to 1, otherwise it is 0. The 5th bit corresponds to the SAE hash-to-element field, which is used to indicate that the hash-to-element method is supported to generate PWE instead of the round-robin method. The 6th bit is a reserved bit used by the Wi-Fi Alliance. The 7th bit corresponds to the Protected WUR Frame Support field. When dot11ProtectedTWTOoperationslmlemented is true, the STA device sets the value of the 7th bit to 1, otherwise it is 0. The 11th bit corresponds to the Protected Announce Support field. When dot11ProtectedTWTOoperationslmlemented is true, the STA device sets the value of the 7th bit to 1, otherwise it is 0. The STA device sets the value of the 4th bit to 1, otherwise it is 0; the 12th bit corresponds to the PBAC field. The STA device sets this bit to indicate that it can establish a protected blocking return protocol, otherwise it is set to 0.

[0073] Based on the above description of the multiple bits of the Extended RSN capabilities field, the first identification bit in the embodiments of the present disclosure may be at least one bit other than the bits shown above. For example, the first identification bit may be bit 8 in the Extended RSN capabilities field, or bit 1 in the Extended RSN capabilities field.

[0074] Among them, when the identification value of the first identification bit is the first value, it is used to indicate that the first device supports the new AAD construction.

[0075] The first value may be 1, which is not limited here.

[0076] In the data frame encryption method applied to the first device provided in the embodiment of the present disclosure, the new AAD also includes parameter information of the duration (Duration) field in the MAC header.

[0077] That is, for any unencrypted MPDU, the new AAD also includes parameter information of the duration field in the MAC header of the MPDU.

[0078] Optionally, when constructing a new AAD, in addition to the parameter information of the relevant information fields involved in the prior art, the parameter information of the duration (Duration) field in the MAC header also participates in the construction of the new AAD.

[0079] In the data frame encryption method applied to the first device provided in the embodiment of the present disclosure, the new AAD further includes at least one of the following:

[0080] Parameter information of the More fragments field in the Frame Control field;

[0081] Parameter information of the Retry field in the Frame Control field;

[0082] Parameter information of the Power Management field in the Frame Control field;

[0083] Parameter information of the More Data field in the Frame Control field;

[0084] Parameter information of the high throughput control indication (+HTC) field in the frame control (Frame Control) field.

[0085] That is, for any unencrypted MPDU, the new AAD also includes at least one of the following items in the Frame Control field in the MAC header of the MPDU:

[0086] Parameter information for the More fragments field;

[0087] Parameter information of the retry field;

[0088] Parameter information of the Power Management domain;

[0089] Parameter information of the More Data field;

[0090] Parameter information of the high throughput control indication (+HTC) field.

[0091] The More Fragment field indicates whether the unencrypted MPDU frame has more fragments. The Retry field indicates whether the unencrypted MPDU frame needs to be retransmitted. When the Power Management field is set to 1, it indicates that the STA device will turn off the antenna and enter a sleep state after sending the MPDU frame. If the MPDU frame is sent by the AP device, the Power Management field is set to 0. The More Data field indicates that the current MPDU frame will have more data after transmission. The +HTC field indicates whether the MAC header of the current MPDU frame includes the High Throughput Control (HT Control) field.

[0092] Optionally, when constructing a new AAD, in addition to the parameter information of the relevant information fields involved in the prior art, parameter information of the More fragments field, the Retry field, the Power Management field, the More Data field, or parameter information of at least one item in the High Throughput Control Indication (+HTC) field also participates in the construction of the new AAD.

[0093] In the data frame encryption method applied to the first device provided in the embodiment of the present disclosure, the new AAD also includes parameter information of the sequence number field (Sequence Number) field of the sequence control (Sequence Control) field in the MAC header.

[0094] Among them, in the existing AAD construction method, the sequence number field (Sequence Number) of the sequence control (Sequence Control) field is shielded. For any unencrypted MPDU, the new AAD also includes at least the parameter information of the sequence number field (Sequence Number) of the sequence control (Sequence Control) field in the MAC header of the MPDU.

[0095] Optionally, when constructing a new AAD, in addition to the parameter information of the relevant information fields involved in the prior art, the parameter information of the sequence number field (Sequence Number) field of the sequence control (Sequence Control) field in the MAC header participates in the construction of the new AAD.

[0096] Optionally, when the Sequence Control field includes a Fragment Number field, the new AAD may include parameter information of the Fragment Number field, or may include parameter information of the Fragment Number field and the Sequence Number field, without limitation here.

[0097] The format of the sequence control field can be as follows:

[0098] When the Fragment Number field does not exist, only the Sequence Number field parameter information of the Sequence Control field participates in the construction of the new AAD.

[0099] In the data frame encryption method applied to the first device provided in the embodiment of the present disclosure, the new AAD also includes parameter information of the high throughput control (HT Control) field in the MAC header.

[0100] Optionally, when constructing a new AAD, in addition to the parameter information of the relevant information fields involved in the prior art, all parameter information of the high throughput control (HT Control) field in the MAC header participates in the construction of the new AAD.

[0101] Optionally, when constructing a new AAD, in addition to the parameter information of the relevant information fields involved in the prior art, part of the parameter information of the high throughput control (HT Control) field in the MAC header participates in the construction of the new AAD.

[0102] The format of the High Throughput Control (HT Control) field may be as follows:

[0103] Optionally, the High Throughput Control (HT Control) field includes multiple variants, such as HT variants, VHT variants, and HE variants. In the table above, bits B0 and B1 are used to jointly indicate the format of the High Throughput Control (HT Control) field. Furthermore, the HT variant and VHT variant include a High Throughput Control Middle (HT Control Middle) field, an Access Type Constraint (AC Constraint) field, and a Reverse Direction Grant (RDG) / More PPDU (RDG / More PPDU) field and subfields, with the second bit representing the Reverse Direction Grant / More PPDU (RDG / More PPDU) subfield.

[0104] Based on this, when constructing a new AAD, in addition to the parameter information of the relevant information fields involved in the existing technology, since the parameters of the bits used to indicate the format of the high throughput control field are not intended to affect data security this time, in the high throughput control (HT Control) field in the MAC header, except for the format bits used to indicate the throughput control (HT Control) field, the parameter information of other bits is involved in the construction of the new AAD.

[0105] For example, if the high throughput control (HT Control) field is an HT variant, when constructing a new AAD, in addition to the parameter information of the relevant information field involved in the prior art, the parameter information indicated by the other bits in the high throughput control (HT Control) field except the B0 bit participates in the construction of the new AAD.

[0106] If the high throughput control (HT Control) field is a VHT variant or a HE variant, when constructing a new AAD, in addition to the parameter information of the relevant information field involved in the prior art, the parameter information indicated by the other bits in the high throughput control (HT Control) field except the B0 and B1 bits participate in the construction of the new AAD.

[0107] When the High Throughput Control (HT Control) domain participates in the construction of a new AAD, sensitive information in the High Throughput Control (HT Control) domain can be prevented from being exploited by attackers, thereby improving spectrum utilization. For example, as shown in the table below, for the Throughput Control (HT Control) domain of the HE variant, the Throughput Control (HT Control) domain may include an Aggregated Control (A Control) domain. The A Control domain may include a Control List (Control List) domain and a Padding (Padding) domain, where the Control List domain may include a Control Identification (Control ID) and Control Information, among others.

[0108] Among them, when the value of Control ID is 0, it is used to indicate that the Control Information field includes triggered response scheduling (TRS) information, when the value is 1, it is used to indicate that the Control Information field includes operating mode (OM) information, when the value is 2, it is used to indicate that the Control Information field includes high throughput link adaptation (HLA) information, when the value is 3, it is used to indicate that the Control Information field includes buffer status report (BSR) information, when the value is 4, it is used to indicate that the Control Information field includes uplink power headroom (UPH) information, when the value is 5, it is used to indicate that the Control Information field includes bandwidth query report (TRS) information, when the value is 6, it is used to indicate that the Control Information field includes command and status (CAS) information, and when the value is 15, it is used to indicate that the Control Information field includes one need expansion surely (ONES) information.

[0109] When the high throughput control (HT Control) domain participates in constructing a new AAD, the relevant information indicated by the Control Information in the high throughput control (HT Control) domain can be prevented from being exploited by attackers, thereby improving spectrum utilization.

[0110] In the data frame encryption method applied to the first device provided in the embodiment of the present disclosure, in the process of constructing a new AAD, the length of the new AAD finally constructed is different according to the different information domains participating in the construction of the new AAD in the frame control domain, the sequence control domain, and the high throughput control domain, that is, the final length of the new AAD is specifically determined by the length of the information domain participating in the construction of the new AAD.

[0111] In the data frame encryption method applied to the first device provided in the embodiment of the present disclosure, after sending the first wireless frame, the first device can construct a new AAD for encrypting the first MPDU frame based on the MAC frame header of the first MPDU for the first MPDU frame to be sent, thereby constructing an encrypted MPDU frame based on the new AAD corresponding to the first MPDU frame and the first MPDU frame.

[0112] Among them, the process of constructing an encrypted MPDU frame according to the new AAD corresponding to the first MPDU frame and the first MPDU frame can be shown in Figure 1, which will not be repeated here.

[0113] Optionally, when the first device is a STA device, the first wireless frame carrying the first identification bit may be a beacon frame or a reassociation request ((Re)association request) frame; when the first device is an AP device, the first wireless frame carrying the first identification bit may be a beacon frame or a reassociation response ((Re)association response) frame.

[0114] Optionally, the first device may send a first radio frame, indicating that the first device supports the construction of the new AAD through a first identification bit, and may simultaneously receive a second radio frame sent by a second device, wherein the second radio frame indicates that the second device supports the construction of the new AAD through a second identification bit. In this case, the first device may send an encrypted MPDU frame to the second device, and the second device, if it supports the construction of the new AAD, may receive the encrypted MPDU frame and parse it using the corresponding parsing method.

[0115] In the data frame encryption method applied to the first device provided in the embodiment of the present disclosure, the MAC header of the encrypted MPDU frame includes a first indication field, and the first indication field indicates through first indication information that the encrypted MPDU frame is constructed based on the new AAD.

[0116] Among them, when the first device indicates through the first indication information that the encrypted MPDU frame is constructed based on the new AAD, it can further instruct the receiving device of the encrypted MPDU frame to decrypt and read the encrypted MPDU frame based on the corresponding decryption method.

[0117] Optionally, the MAC header of the encrypted MPDU includes a frame control field, the frame control field includes a protocol version field, and the first indication field is the protocol version field in the frame control field.

[0118] Optionally, the first indication information may be 10 or other indication information, which is not limited here.

[0119] As an example, the first device sends an encrypted MPDU frame. When the value of the protocol version field in the encrypted MPDU frame is 10, it is used to indicate that the AAD corresponding to the encrypted MPDU frame is constructed in a new way.

[0120] The new AAD provided based on the embodiments of the present disclosure can add parameter information of multiple information fields compared to the existing technology, such as the high throughput control field in the MAC header, the duration field in the MAC header, the sequence number field of the sequence control field in the MAC header, the more fragmentation field in the frame control field, the retransmission field in the frame control field, the power management field in the frame control field, the more data field in the frame control field, and the parameter information of at least one information field in the high throughput control indication field in the frame control field. Therefore, compared with the existing technology, it can more comprehensively ensure the data security of the data frames to be transmitted and improve the data transmission efficiency.

[0121] As shown in FIG5 , an embodiment of the present disclosure provides a data frame encryption device, including:

[0122] A determining unit 51 is configured to determine a first radio frame, where the first radio frame includes a first identification bit, and the first identification bit is configured to indicate that the first device supports construction of new additional authentication data AAD;

[0123] The communication unit 52 is configured to send the first wireless frame.

[0124] Optionally, in an embodiment of the present disclosure, the new AAD includes parameter information of a high throughput control field in a media access control MAC header.

[0125] Optionally, in an embodiment of the present disclosure, the first radio frame includes an extended robust security network capability field, and the extended robust security network capability field includes the first identification bit.

[0126] Optionally, in an embodiment of the present disclosure, the new AAD further includes parameter information of the duration field in the MAC header.

[0127] Optionally, in an embodiment of the present disclosure, the new AAD further includes parameter information of the sequence number field of the sequence control field in the MAC header.

[0128] Optionally, in the embodiment of the present disclosure, the new AAD further includes at least one of the following:

[0129] Parameter information of more slice fields in the frame control field;

[0130] Parameter information of the retransmission field in the frame control field;

[0131] Parameter information of the power management field in the frame control field;

[0132] Parameter information of more data fields in the frame control field;

[0133] Parameter information of the high throughput control indication field in the frame control field.

[0134] Optionally, in an embodiment of the present disclosure, when the above-mentioned first device is a STA device, the above-mentioned first wireless frame is a beacon frame or a reassociation request frame; when the above-mentioned first device is an AP device, the above-mentioned first wireless frame is a beacon frame or a reassociation response frame.

[0135] Optionally, in the embodiment of the present disclosure, the determining unit 51 is further configured to:

[0136] Constructing a new AAD for encrypting a first media access control protocol data unit (MPDU) frame, and constructing an encrypted MPDU frame according to the first MPDU and the new AAD corresponding to the first MPDU frame;

[0137] The communication unit 52 is further configured to:

[0138] Send the encrypted MPDU frame.

[0139] Optionally, in an embodiment of the present disclosure, the MAC header of the encrypted MPDU frame includes a first indication field, and the first indication field indicates that the encrypted MPDU frame is constructed based on a new AAD through first indication information.

[0140] Optionally, in an embodiment of the present disclosure, the first indication field is a protocol version field in a frame control field.

[0141] The present disclosure also provides an electronic device, as shown in FIG6 . The electronic device 600 shown in FIG6 includes a processor 601 and a memory 603. The processor 601 and the memory 603 are connected, for example, via a bus 602. Optionally, the electronic device 600 may further include a transceiver 604. It should be noted that in actual applications, the number of transceivers 604 is not limited to one, and the structure of the electronic device 600 does not constitute a limitation on the present disclosure.

[0142] The memory 603 is used to store application code for executing the embodiments of the present disclosure, and is controlled by the processor 601. When the electronic device 600 serves as the first device, the processor 601 is used to execute the application code stored in the memory 603 to implement the data frame encryption method for the first AP provided in the embodiments of the present disclosure.

[0143] Bus 602 may include a path for transmitting information between the aforementioned components. Bus 602 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, for example. Bus 602 may be divided into an address bus, a data bus, a control bus, and so on. For ease of illustration, FIG6 shows only one thick line, but this does not mean that there is only one bus or only one type of bus.

[0144] The memory 603 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0145] An embodiment of the present disclosure provides a computer-readable storage medium having a computer program stored thereon. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding contents of the aforementioned method embodiment.

[0146] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0147] It should be noted that the computer-readable storage medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium that can transmit, propagate, or convey a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable storage medium may be conveyed using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0148] The computer-readable storage medium may be included in the first device, or may exist independently without being incorporated into the first device.

[0149] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the first device, the first device executes the corresponding data frame encryption method.

[0150] According to one aspect of the present disclosure, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the data frame encryption method provided in the various optional implementations described above.

[0151] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0152] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0153] The modules described in the embodiments of the present disclosure may be implemented in software or hardware. In some cases, the name of a module does not necessarily define the module itself. For example, module A may also be described as "module A for performing operation B."

[0154] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

Claims

1. A data frame encryption method, It is characterized in that Applied to a first device, the method includes: Determine a first radio frame, where the first radio frame includes a first identification bit, where the first identification bit is used to indicate that the first device supports construction of new additional authentication data AAD; The first radio frame is sent.

2. The method according to claim 1, It is characterized in that The new AAD includes parameter information of the high throughput control field in the medium access control MAC header.

3. The method according to claim 1, It is characterized in that The first radio frame includes an extended robust security network capability field, and the extended robust security network capability field includes the first identification bit.

4. The method according to claim 1, It is characterized in that The new AAD also includes parameter information of the duration field in the MAC header.

5. The method according to claim 1, It is characterized in that The new AAD also includes parameter information of the sequence number field of the sequence control field in the MAC header.

6. The method according to claim 1, It is characterized in that The new AAD also includes at least one of the following: Parameter information of more slice fields in the frame control field; Parameter information of the retransmission field in the frame control field; Parameter information of the power management domain in the frame control domain; Parameter information of more data fields in the frame control field; Parameter information of the high throughput control indication field in the frame control field.

7. The method according to claim 1, It is characterized in that When the first device is a STA device, the first wireless frame is a beacon frame or a reassociation request frame; when the first device is an AP device, the first wireless frame is a beacon frame or a reassociation response frame.

8. The method according to claim 1, It is characterized in that The method further comprises: Constructing a new AAD for encrypting a first media access control protocol data unit MPDU frame, and constructing an encrypted MPDU frame according to the first MPDU and the new AAD corresponding to the first MPDU frame; The encrypted MPDU frame is sent.

9. The method according to claim 8, It is characterized in that The MAC header of the encrypted MPDU frame includes a first indication field, and the first indication field indicates that the encrypted MPDU frame is constructed based on a new AAD through first indication information.

10. The method according to claim 9, It is characterized in that The first indication field is a protocol version field in a frame control field.

11. A data frame encryption device, It is characterized in that The device comprises: A determining unit, configured to determine a first radio frame, wherein the first radio frame includes a first identification bit, and the first identification bit is used to indicate that the first device supports construction of new additional authentication data AAD; A communication unit is used to send the first wireless frame.

12. An electronic device, It is characterized in that The electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the method according to any one of claims 1 to 10 when executing the program.

13. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images