A key generation method, system, device, and storage medium

Abstract

This disclosure relates to the field of wireless communication and discloses a key generation method, system, device, and storage medium. The method includes: during fast roaming, a target AP acquires an air interface frame from a STA; calculates PMK_R1 based on information in the air interface frame; calculates a random value RNonce based on PMK_R1; and the target AP returns the random value RNonce to the STA by replying with an air interface frame. This disclosure eliminates the need for PMK R1 key distribution via Ethernet frames, enabling seamless connection and communication between wireless network devices from different manufacturers using the 802.11r fast roaming protocol.

Description

Technical Field

[0001] This disclosure relates to the field of wireless communication technology, specifically to a key generation method, system, device, and storage medium. Background Technology

[0002] In modern wireless local area networks (WLANs), seamless device roaming is crucial for improving user experience. The IEEE 802.11r standard, or Fast Transition (FT) protocol, aims to address latency issues when devices switch between different access points. By proposing a three-layer key structure, 802.11r enables rapid re-authentication during device roaming, ensuring network connectivity continuity and security.

[0003] To enable fast roaming, the 802.11r standard specifies a series of key generation and distribution mechanisms. The R0KH (PMK-R0 key holder in the Authenticator, the PMK-R0 key management entity on the authenticator side, the authenticator being the target AP) generates a PMK_R0 and a corresponding PMK_R1 (Pairwise Master Key_R1) for each AP during initial authentication, and distributes the PMK_R1 among all Access Points (APs) within the Mobility Domain (MD). Each AP uses these keys to perform fast transition authentication with the station (STA) to generate a new PTK (Pairwise Transient Key) for encrypted communication. Because the protocol does not specify the distribution method for the PMK_R1 key, the implementation of the key distribution mechanism varies between vendors, hindering fast roaming. Wired distribution of PMK_R1 keys between APs has limited use cases.

[0004] In the 802.11r protocol, when a STA initially establishes an association with a Mobile Domain MD (MD), the R0KH generates a master key PMK_R0 (Pairwise Master Key_R0) and calculates a corresponding subkey PMK_R1 for each R1KH (PMK-R1 key holder in the Authenticator, the PMK-R1 key management entity on the authenticator side, the authenticator side being the target AP). Subsequently, the R0KH distributes these PMK_R1s to each R1KH within the MD. Afterwards, when the STA roams, it can calculate the PTK using the pre-allocated PMK_R1; if the target AP's R1KH does not store the PMK_R1 requested by the STA, the R0KH recalculates PMK_R1 and PMKR1Name based on the R1KH_ID and sends it to the requesting R1KH to achieve fast roaming authentication. This key distribution process is as follows: Figure 1 As shown, Figure 1 In this context, WTP (Wireless Transaction Protocol) is a communication protocol used in wireless network environments for data transmission and transaction processing between mobile devices. R0KH and R1KH are the key management entities on the authenticator (target AP) side. R0KH controls the calculation of PMK_R0 and PMK_R1, and is also responsible for providing PMK_R1 to R1KH. R1KH controls the calculation of PTK. S0KH is the PMK-S0 key management entity on the applicant (STA) side, and S1KH is the PMK-S1 key management entity on the applicant (STA) side. The functions of S0KH and S1KH correspond to those of R0KH and R1KH. R0KH-ID is the identifier (NAS-ID) of R0KH, which is 1-48 bytes long according to the IEEE standard and can be customized by the manufacturer. Both R0KH-ID and R1KH-ID are the MAC addresses of the authenticator. Both S0KH-ID and S1KH-ID are the MAC addresses of the applicant (STA). This process demonstrates that PMK_R1 distribution is integral to the entire roaming authentication process. However, due to significant differences in the protocols used by different chip solutions to distribute PMK_R1, interoperability is impossible. Therefore, a local key management and distribution mechanism is needed to achieve interoperability between different chip solutions. Summary of the Invention

[0005] This disclosure provides a key generation method, system, device, and storage medium to solve or alleviate one or more of the above-mentioned technical problems in the prior art.

[0006] According to one aspect of this disclosure, a key generation method is provided, comprising:

[0007] During rapid roaming, the target AP acquires the STA air interface frame;

[0008] Calculate PMK_R1 based on the information in the air interface frame;

[0009] Calculate the random value RNonce based on PMK_R1;

[0010] The target AP returns the random value RNonce to the STA by replying with an air interface frame.

[0011] In one possible implementation, the target AP returns the random value RNonce to the STA via a reply air interface frame, including:

[0012] After receiving the random value RNonce, STA calculates PTK using the random value RNonce and STA's own SNonce;

[0013] The STA and the target AP are re-associated via PTK.

[0014] One possible implementation includes:

[0015] The information in the air interface frame includes SSID, MDID, R0KH_ID and S0KH_ID. SSID is the service set identifier; MDID is the Mesh distributed identifier; R0KH_ID is the PMK-R0 key management entity identifier of the target AP; and S0KH_ID is the PMK-S0 key management entity identifier of the STA.

[0016] In one possible implementation, calculating PMK_R1 based on information in the air interface frame includes:

[0017] SSIDlength is calculated based on the length of the SSID string.

[0018] Calculate R0KHlength based on the length of the R0KH_ID string; R0KHlength is the length of R0KH_ID.

[0019] Calculate PMK_R0 based on SSIDlength, SSID, MDID, R0KHlength, R0KH_ID, and S0KH_ID;

[0020] Then, PMK_R1 is calculated based on PMK_R0 and R1KH_ID and R0KH_ID in the air interface frame.

[0021] In one possible implementation, PMK_R0 is calculated as follows:

[0022] R0_Key_Data=KDF_384(XXXKey,"FT_R1",SSIDlength||SSID

[0023] ||MDID||R0KHlength||R0KH_ID||S0KH_ID)

[0024] PMK_R0=L(R0_Key_Data,0,256);

[0025] In the formula, R0_Key_Data represents the R0 key data; KDF_384 represents the key derivation function using a 384-bit output; XXXKey represents the pre-shared key; "FT_R1" represents the identifier, which is a fixed value; PMK_R0 represents the paired master key R0; L(R0_Key_Data,0,256) means taking 256 bits starting from the 0th bit of R0_Key_Data as the value of PMK_R0.

[0026] In one possible implementation, PMK_R1 is calculated as follows:

[0027] PMK_R1=KDF_256(PMK_R0,"FT_R1","R1KH_ID"||"R0KH_ID");

[0028] In the formula, PMK_R1 represents the paired master key R1; KDF_256 represents the key derivation function using 256-bit output; and R1KH_ID represents the PMK-R1 key management entity identifier of the target AP.

[0029] According to one aspect of this disclosure, a key generation system is provided, comprising:

[0030] The target AP is used to acquire STA air interface frames during rapid roaming.

[0031] Calculate PMK_R1 based on the information in the air interface frame;

[0032] Calculate the random value RNonce based on PMK_R1;

[0033] The target AP returns the random value RNonce to the STA by replying with an air interface frame.

[0034] In one possible implementation, the key generation system also includes:

[0035] STA is used to calculate PTK using the random value RNonce and STA's own SNonce after receiving the random value RNonce.

[0036] The reassociation unit is used to reassociate the STA with the target AP via PTK.

[0037] This disclosure has the following beneficial effects: This disclosure designs a method for locally generating keys based on 802.11r. The distribution of PMK R1 can be locally calculated using information such as PMK-R0, R1KH_ID, and R0KH_ID, without the need to distribute PMK R1 keys through Ethernet frames. This enables seamless connection and communication between wireless network devices produced by different manufacturers using the 802.11r fast roaming protocol.

[0038] Details of one or more embodiments of this application are set forth in the following drawings and description. Other features and advantages of this application will become apparent from the accompanying drawings. It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not intended to limit this disclosure. Attached Figure Description

[0039] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0040] Figure 1 This is a schematic diagram of the key distribution process in existing technologies;

[0041] Figure 2 This is a flowchart of a key generation method according to an exemplary embodiment of the present invention;

[0042] Figure 3 This is a flowchart illustrating the local key calculation process of this exemplary embodiment;

[0043] Figure 4 This is a schematic diagram of the rapid over-the-air switching of this exemplary embodiment;

[0044] Figure 5 This is a schematic diagram of fast switching over-the-DS in this exemplary embodiment;

[0045] Figure 6 This is a block diagram of a key generation system according to an exemplary embodiment of the present invention;

[0046] Figure 7 This is a schematic diagram of the structure of a device according to an exemplary embodiment of this invention. Detailed Implementation

[0047] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the example embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more of the specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0048] Furthermore, the same reference numerals in the accompanying drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware units or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0049] The flowchart shown in the attached diagram is merely an illustrative example and does not necessarily include all steps. For example, some steps may be broken down, while others may be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0050] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein.

[0051] Furthermore, the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, such that a process, method, system, product, or device that includes a series of steps or sub-modules is not necessarily limited to those steps or sub-modules that are explicitly listed, but may include other steps or sub-modules that are not explicitly listed or that are inherent to such process, method, product, or device.

[0052] Figure 2 This is a flowchart of a key generation method according to an exemplary embodiment of the present invention, such as... Figure 2 As shown, an exemplary embodiment of this disclosure provides a key generation method, including:

[0053] During rapid roaming, the target AP acquires the STA air interface frame;

[0054] Calculate PMK_R1 based on the information in the air interface frame;

[0055] Calculate the random value RNonce based on PMK_R1;

[0056] The target AP returns the random value RNonce to the STA by replying with an air interface frame.

[0057] Specifically, during fast roaming, the STA (Station, terminal) will transmit the air interface frame (i.e., Figure 4 The Authentication Request is sent to the target AP (Access Point);

[0058] After receiving the air interface frame, the target AP calculates PMK_R1 (Pairwise MasterKey_R1) based on the information in the air interface frame, and calculates the random value RNonce (Reassociation Nonce) based on PMK_R1.

[0059] The target AP returns the random value RNonce to the STA by replying with an air interface frame;

[0060] After receiving the random value RNonce, STA uses the random value RNonce and STA's own SNonce (server random number) to calculate PTK (Pairwise Transient Key).

[0061] The STA and the target AP are re-associated via PTK.

[0062] This embodiment designs a method for locally generating keys based on 802.11r. For PMK R1, it can be locally calculated using information such as PMK_R0 (Pairwise Master Key_R0), R1KH_ID, and R0KH_ID, and distributed through air interface frames. There is no need to distribute PMK_R1 keys through Ethernet frames, which can realize 802.11r interoperability between different chips, reduce roaming latency, and enable devices to roam more efficiently and quickly.

[0063] Fast Basic Service Set Transition (FBT) can be divided into two modes based on the handover method: Over-the-Air and Over-the-DS. Over-the-Air means that the STA communicates directly with the target AP; Over-the-DS means that the STA communicates with the target AP through the current AP.

[0064] Specifically, during fast roaming, the STA sends air interface frames to the target AP, including:

[0065] In Over-the-Air mode:

[0066] The STA sends an air interface frame to the target AP. The RSNIE (Robust Security Network Information Element) in the air interface frame contains PMKR0_Name (Pairwise Master Key R0_Name), and the FTIE (Fast Basic Services Set Transition Information Element) contains SNonce (server random number), R0KH_ID (PMK-R0 key management entity identifier at the target AP), and MDIE (key deployment information element).

[0067] like Figure 4 ( Figure 4 In this context, "Associated with current AP" indicates association with the current AP; FTAA stands for Fast Terminal Authentication Algorithm; FTIE stands for Fast Terminal Integrity Evaluation; and RIC stands for Radio Identity Code. As shown in this embodiment, in Over-the-Air mode, the distribution and fast switching authentication process based on the locally generated key is as follows:

[0068] During fast roaming, the STA sends an air interface frame to the AP. The RSNIE in the air interface frame contains PMKR0_Name, and the FTIE contains SNonce, R0KH_ID, and MDIE. The verification algorithm for the air interface frame is FT (Fast Transition).

[0069] Specifically, after the target AP receives the air interface frame, it calculates PMK_R1 based on the information in the air interface frame, including:

[0070] After the target AP receives the air interface frame, it calculates PMK_R0 based on the SSID (Service Set Identifier), MDID, R0KH_ID, and STA MAC address information in the air interface frame.

[0071] Then, PMK_R1 is calculated based on PMK_R0 and R1KH_ID and R0KH_ID in the air interface frame.

[0072] Specifically, re-associating the STA with the target AP via PTK includes:

[0073] The STA sends a Reassociation Request frame to the target AP. The Reassociation Request frame contains PMKR1Name, Anonce (AP random number), Snonce, MIC (Message Integrity Check) value, R1KH_ID and R0KH_ID.

[0074] After receiving the Reassociation Request frame, the target AP verifies the correctness of the Reassociation Request frame;

[0075] If the verification is successful, a Reassociation Response frame is sent back to the STA. The Reassociation Response frame contains an encrypted GTK (Group Temporal Key).

[0076] The STA uses PTK to decrypt and obtain GTK, thus re-associating the STA with the target AP.

[0077] After reconnection is complete, the 802.1X controlled port is open, and the STA can use the network normally.

[0078] Specifically, the formula for calculating PMK_R0 is as follows:

[0079] R0_Key_Data=KDF_384(XXXKey,"FT_R1",SSIDlength||SSID

[0080] ||MDID||R0KHlength||R0KH_ID||S0KH_ID)

[0081] PMK_R0=L(R0_Key_Data,0,256);

[0082] In the formula, R0_Key_Data represents the R0 key data; KDF_384 represents the key derivation function using a 384-bit output; XXXKey represents the pre-shared key; "FT_R1" represents the identifier; SSIDlength is the length of the SSID; SSID is the service set identifier; MDID is the Mesh distributed identifier; R0KHlength is the length of R0KH_ID; R0KH_ID is the R0 key holder identifier; S0KH_ID is the S0 key holder identifier; PMK_R0 represents the paired master key R0; L(R0_Key_Data,0,256) means taking 256 bits starting from the 0th bit of R0_Key_Data as the value of PMK_R0.

[0083] like Figure 3 As shown (Wtp stands for Wireless Termination Point), specifically, the formula for calculating PMK_R1 is:

[0084] PMK_R1=KDF_256(PMK_R0,"FT_R1","R1KH_ID"||"R0KH_ID");

[0085] In the formula, PMK_R1 represents the paired master key R1; KDF_256 represents the key derivation function using a 256-bit output; and R1KH_ID represents the R1 key holder identifier.

[0086] In this embodiment, a new random value RNonce is calculated using PMK_R1, and this random number is used together with the previous PMKR1 to generate a new PTK. The AP returns RNonce to the STA via an Authentication Response frame.

[0087] After receiving the RNonce, the STA calculates the new PTK using its own SNonce and RNonce. The STA then sends a Reassociation Request to the target AP, which includes PMKR1Name, Anonnce, Snonce, MIC value, R1KH-ID, and R0KH-ID.

[0088] The target AP receives the reassociation air interface frame and verifies its correctness. If the verification is successful, it replies to the STA with a ReassociationResponse frame containing the encrypted GTK. The STA uses PTK to decrypt and obtain the GTK. After reassociation is complete, the 802.1X controlled port opens, and the STA can use the network normally.

[0089] Specifically, during fast roaming, the STA sends air interface frames to the target AP, including:

[0090] In Over-the-DS mode:

[0091] The STA sends an FT Request (Fast BSS Transition Request) containing the target AP's MAC address to the current AP;

[0092] The current AP forwards the FT Request frame to the target AP via wired transmission;

[0093] After receiving the FT Request frame, the target AP identifies the forwarding source and replies with an FT Request frame, which is then forwarded to the STA through the current AP.

[0094] like Figure 5 As shown, in Over-the-DS mode, the reassociation process is similar to Over-the-Air, except for the first two steps: The STA first sends an FT Request frame containing the target AP's MAC address to the current AP, which then forwards the frame to the target AP via wired transmission. Specifically, after receiving the STA's FT Request frame, the current AP recognizes that the target address is not itself, encapsulates the frame in an Ethernet type 0x890d frame, appends its own address, and forwards it to the target AP via Ethernet. Upon receiving the frame, the target AP identifies the source of the forwarding and replies with the corresponding FT Request frame, which is ultimately forwarded to the STA via the current AP.

[0095] Figure 6 This is a block diagram of a key generation system according to an exemplary embodiment of the present invention, such as Figure 6 As shown, an exemplary embodiment of this disclosure provides a key generation system, including:

[0096] The target AP is used to acquire STA air interface frames during rapid roaming.

[0097] Calculate PMK_R1 based on the information in the air interface frame;

[0098] Calculate the random value RNonce based on PMK_R1;

[0099] The target AP returns the random value RNonce to the STA by replying with an air interface frame.

[0100] Specifically, the key generation system also includes:

[0101] STA is used to calculate PTK using the random value RNonce and STA's own SNonce after receiving the random value RNonce.

[0102] The reassociation unit is used to reassociate the STA with the target AP via PTK.

[0103] Figure 7 This is a schematic diagram of the structure of a device according to an exemplary embodiment of this invention. Figure 7 As shown, corresponding to the key generation method provided above, this disclosure also provides a device. Since the embodiment of this device is similar to the method embodiment described above, the description is relatively simple. For relevant details, please refer to the description in the method embodiment section above. The device described below is merely illustrative. This device may include: a processor 1, a memory 2, a communication bus (i.e., the aforementioned device bus), and a lookup engine. The processor 1 and memory 2 communicate with each other via the communication bus and communicate with external systems via a communication interface. The processor 1 can invoke logical instructions in the memory 2 to execute the key generation method.

[0104] Furthermore, the logical instructions in the aforementioned memory 2 can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as memory chips, USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0105] On the other hand, this disclosure also provides a processor-readable storage medium storing a computer program 3, which, when executed by a processor 1, is implemented to perform the key generation methods provided in the above embodiments.

[0106] The processor-readable storage medium can be any available medium or data storage device that the processor 1 can access, including but not limited to magnetic memory (e.g., floppy disk, hard disk, magnetic tape, magneto-optical disk (MO)), optical memory (e.g., CD, DVD, BD, HVD), and semiconductor memory (e.g., ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state drive (SSD)).

[0107] The above are merely preferred embodiments of this disclosure. The scope of protection of this disclosure is not limited to the above embodiments. All technical solutions falling within the scope of this disclosure are protected. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of this disclosure should be considered within the scope of protection of this disclosure.

Claims

1. A method of key generation, characterized by, Comprise: In the fast roaming process, the target AP acquires the STA air interface frame; The target AP calculates PMK_R1 according to PMK_R0 and the information in the air interface frame; Calculate the random value RNonce according to PMK_R1; The target AP returns the random value RNonce to the STA through the reply air interface frame; The calculation formula of PMK_R0 is: R0_Key_Data = KDF_384(XXXKey, "FT_R1", SSIDlength || SSID|| MDID ||R0KHlength || R0KH_ID || S0KH_ID) PMK_R0=L(R0_Key_Data, 0, 256); In the formula, R0_Key_Data represents R0 key data; KDF_384 represents a key derivation function with a 384-bit output; XXXKey represents a pre-shared key; "FT_R1" represents an identifier, which is a fixed value; PMK_R0 represents a pair of master keys R0; L(R0_Key_Data, 0, 256) represents taking 256 bits from the 0th bit of R0_Key_Data as the value of PMK_R0.

2. The key generation method according to claim 1, wherein After the target AP returns the random value RNonce to the STA through the reply air interface frame, it comprises: After receiving the random value RNonce, the STA calculates PTK using the random value RNonce and the SNonce of the STA itself; Complete the re-association of the STA and the target AP through PTK.

3. The key generation method of claim 1, wherein, Comprise: The information in the air interface frame includes SSID, MDID, R0KH_ID and S0KH_ID, SSID is a service set identifier; MDID is a mesh distributed identifier; R0KH_ID is the PMK-R0 key management entity identifier of the target AP; S0KH_ID is the PMK-S0 key management entity identifier of the STA.

4. The key generation method according to claim 3, wherein According to the information in the air interface frame, the calculation of PMK_R1 comprises: Calculate SSIDlength according to the SSID string length, SSIDlength is the length of SSID; Calculate R0KHlength according to the R0KH_ID string length, R0KHlength is the length of R0KH_ID; Calculate PMK_R0 according to SSIDlength, SSID, MDID, R0KHlength, R0KH_ID, S0KH_ID; Then calculate PMK_R1 according to PMK_R0 and R1KH_ID and R0KH_ID in the air interface frame.

5. The key generation method of claim 1, wherein, The calculation formula of PMK_R1 is: PMK_R1=KDF_256(PMK_R0, "FT_R1","R1KH_ID" || "R0KH_ID"); In the formula, PMK_R1 represents a pair of master keys R1; KDF_256 represents a key derivation function with a 256-bit output; R1KH_ID represents the PMK-R1 key management entity identifier of the target AP.

6. A key generation system, characterized by, A key generation method according to any one of claims 1-5, comprising: a target AP, configured to obtain a STA air interface frame in a fast roaming process; calculating PMK_R1 according to information in the air interface frame; calculating a random value RNonce according to PMK_R1; the target AP returning the random value RNonce to the STA through a reply air interface frame.

7. The key generation system of claim 6, wherein, Further comprising: a STA, configured to calculate PTK by using the random value RNonce and an SNonce of the STA after receiving the random value RNonce; a re-association unit, configured to complete re-association of the STA and the target AP by using the PTK.

8. An apparatus, comprising: comprising: a processor and a memory; the memory is configured to store a computer program, and the processor is configured to invoke the computer program stored in the memory to execute the key generation method according to any one of claims 1-5.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and when the computer program is executed by the processor, the processor can execute the key generation method according to any one of claims 1-5.

Images