Systems and methods for communicating using probe messages in network

Abstract

The disclosure relates to systems and methods for communicating using probe messages in a network. Systems and methods use a protocol for secure probe exchange. Some embodiments relate to a first device. The first device includes circuitry configured to provide at least one frame to a second device across a connection in response to an unprotected broadcast probe request message. The frame contains an unprotected unicast probe response message. In some embodiments, the unprotected broadcast probe request message may refer to a broadcast message (e.g., a management frame) that requests response and is not encrypted.

Description

Technical Field

[0001] The present disclosure generally relates to systems and methods for communication between access points (APs) and client devices (e.g., stations (STAs)) or other communication devices. In some embodiments, the present disclosure generally relates to systems and methods related to probe and / or probe response messages (including but not limited to secure probe exchange protocols). Background Art

[0002] Over the past few decades, the wireless communication device market has grown by orders of magnitude driven by the use of portable devices and the increase in connectivity and data transfer between a wide variety of devices. Digital switching technology has facilitated the large-scale deployment of inexpensive, easy-to-use wireless communication networks. In addition, improvements in digital and radio frequency (RF) circuit manufacturing and advances in circuit integration and other aspects have made wireless devices smaller, cheaper and more reliable. Wireless communications can operate according to various standards such as IEEE802.11x, Bluetooth, Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), etc. With the development of higher data throughput and other changes, newer standards are being developed for adoption, such as the progress from IEEE 802.11n to IEEE 802.11ac.

[0003] Establishing a connection for communication between an access point (AP) and a client device (e.g., a station (STA)) or other communication devices may involve probe and / or probe response messages. Protocols for establishing connections (e.g., discovering connections, authenticating / deauthenticating connections, and associating / disassociating) using probe messages may increase communication overhead and may provide opportunities for security vulnerabilities. Summary of the invention

[0004] In one aspect, the disclosure is directed to a first device comprising circuitry configured to provide at least one frame to a second device across a connection in response to an unprotected broadcast probe request message, the frame comprising an unprotected unicast probe response message.

[0005]

[0011] In another aspect, the disclosure relates to a first device comprising circuitry configured to provide at least one frame to a second device across a connection in response to a protected unicast probe request message, the frame comprising a protected unicast probe response message.

[0006] In yet another aspect, the present disclosure relates to a first device comprising: a circuit configured to provide at least one frame to a second device across a connection, the frame comprising a protected unicast probe request message, wherein the circuit is configured to discard an unprotected unicast message provided after receiving a protected unicast probe response message from the second device in response to the protected unicast probe request message.

[0007] In another aspect, the present disclosure relates to a method comprising: establishing a connection between a first device and a second device; providing an unprotected broadcast probe request message from the first device to the second device across the connection; and receiving an unprotected unicast probe response message from the second device at the first device, wherein the first device is a station device supporting beacon protection and the second device is an access point with beacon protection enabled. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Various objects, aspects, features and advantages of the present disclosure will become more apparent and better understood by referring to the detailed description in conjunction with the accompanying drawings, wherein like reference characters identify corresponding elements throughout the drawings. In the drawings, like reference numerals generally indicate identical, functionally similar and / or structurally similar elements.

[0009] Figure 1A is a block diagram depicting a network environment including one or more access points (APs) in communication with one or more devices or stations (STAs) according to some embodiments.

[0010] Figure 1B and 1C is a block diagram depicting a computing device suitable for use in conjunction with the methods and systems described herein, according to some embodiments.

[0011] Figure 2A is a block diagram depicting a network including APs and STAs according to some embodiments.

[0012] Figure 2B According to some embodiments Figure 2A A more detailed block diagram of an AP or STA in a network configured for probe request / probe response operations is illustrated in FIG.

[0013] Figure 3 is a diagram illustrating some embodiments of the Figure 2B Flowchart of the probe request operation of an AP or STA illustrated in FIG.

[0014] Figure 4 is a diagram illustrating some embodiments of the present invention. Figure 2B Flowchart of a protected unicast probe request operation of an AP or STA illustrated in FIG.

[0015] Figure 5 is a diagram illustrating some embodiments of the present invention. Figure 2B Flowchart of an unprotected unicast probe request operation of an AP or STA illustrated in FIG.

[0016] Figure 6is a flow chart depicting a protected unicast probe request operation when a connection between an AP and a STA is reestablished due to a reset / restart without sending a Disassociation Request to the associated AP.

[0017] The details of various embodiments of the method and system are set forth in the accompanying drawings and the description below. DETAILED DESCRIPTION

[0018] The following IEEE standards (including any draft versions of such standards) are hereby incorporated by reference in their entirety and made a part of this disclosure for all purposes: WiFi Alliance standards and IEEE 802.11 standards, including but not limited to IEEE 802.11a TM 、IEEE 802.11b TM 、IEEE 802.11g TM 、IEEE 802.11be TM 、IEEEP802.11n TM ;IEEE P802.11ax TM ; and IEEE P802.11ac TM Although the present disclosure may refer to aspects of these standards, the present disclosure is in no way limited to these standards.

[0019] For the purpose of reading the following description of various embodiments, the following description of the various sections of this specification and their corresponding contents may be helpful:

[0020] - Section A describes a network environment and a computing environment that may be suitable for practicing the embodiments described herein; and

[0021] - Section B describes a protocol for probe request / response operations and embodiments of methods and apparatus using such a protocol.

[0022] Some embodiments disclosed herein relate to a protocol for secure probe request / response exchange between a connected client and an AP. In some embodiments, a protocol is provided for a WiFi network (e.g., an IEEE 802.11 network, etc.), a cellular network, a point-to-point communication, or a combination thereof. In some embodiments, the protocol can be used with a Wi-Fi AP to enhance connection security and reduce the time to establish a connection. In some embodiments, a device that supports protected management frames and beacon protection capabilities utilizes the protocol. In some embodiments, the system and method provide a secure probe request / response between an AP and a STA that supplements a beacon protection feature (e.g., a beacon protection feature of the 802.11 standard). In some embodiments, the system and method use the protocol to reestablish a connection between an AP and a STA in a secure manner, thereby reducing the connection time. In some embodiments, the AP is an AP with beacon protection enabled and the STA is a STA that supports beacon protection.

[0023] In some embodiments, systems and methods avoid using unprotected individually addressed probe request frames and processing unprotected probe response frames, which may compromise or negate the protection mechanisms introduced by beacon protection handling. In some embodiments, systems and methods provide better security for unicast probe and / or response frames.

[0024] Some embodiments are directed to a method. The method includes establishing a connection between a first device and a second device, and providing an unprotected broadcast probe request message from the first device to the second device across the connection. The method also includes receiving, at the first device, an unprotected unicast probe response message from the second device, wherein the first device is a station device that supports beacon protection and the second device is an access point with beacon protection enabled.

[0025] In some embodiments, the method further includes providing a protected unicast probe request message from the first device to the second device across the connection, and receiving a protected unicast probe response message at the first device from the second device. In some embodiments, the method further includes discarding an unprotected unicast probe response message at the first device for the protected unicast probe request message sent from the first device. In some embodiments, the method further includes providing an unprotected broadcast probe request message from the first device to the second device across the connection, and receiving an unprotected unicast probe response message at the first device from the second device.

[0026] In some embodiments, the method further includes receiving an unprotected unicast probe request message at the second device. The method further includes providing a security association query request from the second device to the first device to receive a security association query response and foregoing sending the unicast probe response message.

[0027] In some embodiments, the method further includes resetting / restarting the first device without any disconnection request from the first device, reestablishing a connection between the first device and the second device after the reset / restart, providing an unprotected unicast probe request message from the first device to the second device across the connection. The method further includes initiating a security association query request from the second device and sending an unprotected unicast probe response message to the first device upon timeout, and receiving an unprotected unicast probe response message from the second device at the first device to continue the connection reestablishment. The first device is a station device supporting beacon protection and the second device is an access point with beacon protection enabled.

[0028] In some embodiments, a connection may refer to a communication established between nodes for exchanging data according to a protocol (e.g., wireless communication between nodes). In some embodiments, a three-way or four-way handshake mechanism (via discovery, authentication, and association operations) is used to establish a connection. In some embodiments, a secure connection may refer to a connection that provides data in a format that is not easily available to the other party. Various methods can establish a secure connection, including but not limited to data encryption methods. In some embodiments, data encryption uses an algorithm for encrypting and decrypting information, including but not limited to: WPA and WPA2 operations in accordance with 802.11 standards (e.g., Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES)). A connection may be a wireless connection to or from a client device (e.g., STA) and an AP, or may be a connection between other types of communication devices. In some embodiments, a wireless network may be an 802.11 WiFi network (e.g., IEEE 802.11be). A client device or AP may be implemented in a device including one or more ICs packaged as an integrated circuit (IC) package. In some embodiments, connection reestablishment or reestablishing may refer to re-forming a connection after it has been disabled, disassociated, deauthenticated, or otherwise interrupted such that normal communications cease to occur across the connection.

[0029] An authentication operation may refer to the process of how a client device accesses a network. Authentication provides proof of identity to ensure that a client device or user is allowed to access a network. An association operation may refer to the process of associating an authenticated client device or user with an AP. Association allows the network to determine where to send data intended for the client device (e.g., sending data through the AP to which the client device is associated). Typically, a client device is associated with only a single AP. In some embodiments, disconnection may refer to a process in which a client device is no longer associated with an AP. In some embodiments, disconnection prevents the AP from continuing to attempt to transmit data to the client device after the connection is canceled. In some embodiments, disconnection typically involves sending a disconnection frame or message from the AP to the client device or from the client device to the AP. In some embodiments, a disconnection request may refer to a message (e.g., a frame) requesting a disconnection operation. A client device may disconnect from an AP while still maintaining authentication on the network. In some embodiments, deauthentication may refer to a process that does not allow any further services to be provided to a client device. In some embodiments, deauthentication typically involves sending a deauthentication frame or message from the AP to the client device or from the client device to the AP.

[0030] In some embodiments, the systems and methods reduce discovery operations (e.g., using scanning to discover AP beacon signals or probe requests). In some embodiments, discovery operations may refer to frame communications used to discover the availability and / or identification (ID) of APs or other wireless devices. Discovery operations may involve the communication of probe request frames and probe response frames.

[0031] Some embodiments relate to a first device. The first device includes circuitry configured to provide at least one frame to a second device across a connection in response to an unprotected broadcast probe request message. The frame includes an unprotected unicast probe response message.

[0032] In some embodiments, an unprotected broadcast probe request message may refer to a broadcast message (e.g., a management frame) that requests a response and is not encrypted. In some embodiments, an unprotected broadcast probe request message may request that a response containing information about the capabilities of one or more service set identifiers in the network be sent and is provided without using key information provided during a four-way handshake associated with a connection. In some embodiments, an unprotected unicast probe response message may refer to a unicast message (e.g., a management frame) that provides a response to a request and is not encrypted. In some embodiments, an unprotected unicast probe response message may contain information about the capabilities of one or more service set identifiers in the network and is provided without using key information provided during a four-way handshake associated with a connection. In some embodiments, a probe response is similar to a beacon frame that contains capability information, authentication information, etc. and is sent only in response to a probe request message.

[0033] In some embodiments, an unprotected unicast probe request message may refer to a unicast message (e.g., a management frame) that requests a response and is not encrypted. In some embodiments, a protected unicast probe request message may refer to a unicast message (e.g., a management frame) that requests a response and is encrypted or otherwise secured. In some embodiments, a protected unicast probe response message may refer to a unicast message (e.g., a management frame) that provides a response to a request and is encrypted or otherwise secured. In some embodiments, a message may refer to data or other data provided between a first device and a second device to communicate parameters, commands, signals, or other data and may include a frame or be in the form of a frame.

[0034] In some embodiments, the frame is provided in accordance with the 802.11 protocol and the connection is established using an association or authentication operation. In some embodiments, the first device is an access point with beacon protection enabled. In some embodiments, an access point with beacon protection enabled may refer to an access point capable of operating in accordance with a beacon protection protocol. In some embodiments, the beacon protection protocol may rely on the AP to provide a beacon integrity key to the STA during security association setup and add a message integrity check (MIC) element to the beacon frame, the MIC element covering all parts of the beacon frame content except the timestamp field. In some embodiments, a station device supporting beacon protection may refer to a STA or client device capable of operating in accordance with the beacon protection protocol.

[0035] In some embodiments, the circuitry is configured to provide a protected unicast probe response message to the second device across the connection in response to a protected unicast probe request message.

[0036] In some embodiments, the second device is a station device that supports beacon protection.In some embodiments, the circuit is configured to provide a security association query request message in response to an unprotected unicast probe request message from another source.

[0037] In some embodiments, a security association query request may refer to a message (e.g., a management frame) that requests a response and is encrypted or otherwise secured. In some embodiments, a security association query response may refer to a message (e.g., a management frame) that responds to a security association query request and is encrypted or otherwise secured. The security association query request and the security association query response may be provided according to the 802.11 standard.

[0038] In some embodiments, the circuit is configured to provide an unprotected unicast probe response message in response to expiration of a timeout period after the security association query request message is sent. In some embodiments, the timeout period may refer to a time period during which the device waits for a response. After the timeout period, the device may determine that the response being waited for is not available.

[0039] In some embodiments, the circuitry is configured to provide an unprotected unicast probe response message in response to expiration of a timeout period after the security association query request message is sent out.

[0040] Some embodiments relate to a first device. The first device includes circuitry configured to provide at least one frame to a second device across a connection in response to a protected unicast probe request message. The frame includes a protected unicast probe response message.

[0041] In some embodiments, the frame is provided according to the 802.11 protocol and the connection is established using an association or authentication operation. The first device is a beacon protection enabled access point.

[0042] In some embodiments, the circuitry is configured to provide an unprotected unicast probe response message to the second device across the connection in response to an unprotected broadcast probe request message. In some embodiments, the circuitry is configured to provide a security association query request message in response to an unprotected unicast probe request message, and the circuitry is configured to provide an unprotected unicast probe response message in response to expiration of a timeout period after the security association query request message is sent out.

[0043] Some embodiments relate to a first device. The first device includes circuitry configured to provide at least one frame to a second device across a connection. The frame includes a protected unicast probe request message. The circuitry is configured to discard an unprotected unicast message provided after receiving a protected unicast probe response message from the second device in response to the protected unicast probe request message. Dropping or dropping may refer to an operation in which a message is not fully processed. In some embodiments, a message may be discarded or ignored. In some embodiments, the first device is a station device that supports beacon protection.

[0044] Some embodiments relate to a method. The method includes establishing a connection between a first device and a second device, providing an unprotected broadcast probe request message from the first device to the second device across the connection, and receiving an unprotected unicast probe response message at the first device from the second device. The first device is a station device that supports beacon protection and the second device is an access point with beacon protection enabled.

[0045] In some embodiments, the method further includes providing a protected unicast probe request message from the first device to the second device across the connection, and receiving a protected unicast probe response message from the second device at the first device. In some embodiments, the method further includes discarding an unprotected unicast probe response message after receiving the protected unicast probe response message from the second device at the first device. In some embodiments, the method further includes providing a security association query response message from the first device to the second device across the connection in response to a security association query request message from the second device. In some embodiments, the method further includes receiving a security association query request message from the second device across the connection after sending an unprotected unicast probe request message after a restart or refresh of the first device. In some embodiments, a restart or refresh or reset may refer to an operation of restarting, using a boot procedure, performing a power-off / power-on cycle, or resetting a device without sending a disconnection request frame from the first device. In some embodiments, the method further includes receiving an unprotected unicast probe response message from the second device across the connection after a timeout period of the security association query request message.

[0046] In some embodiments, a frame may refer to a digital data transmission unit. For example, a frame may refer to a container for a single network data packet. In some embodiments, a data frame may refer to a frame containing data. In some embodiments, an encrypted frame may refer to a frame that has been encrypted. In some embodiments, a broadcast message or a broadcast frame may refer to a message or frame sent to more than one device in a basic service set (BSS) connected to an AP or communicating with an AP. In some embodiments, a broadcast message or a broadcast frame is sent to all devices in a BSS connected to an AP. A unicast message or a unicast frame may refer to a message or frame with a single destination. In some embodiments, a management frame may refer to a frame used for control or management operations, including but not limited to a beacon frame, a probe request / response frame, an authentication request / response frame, an association request / response frame, a deauthentication frame, a disconnection request (e.g., a frame), etc.

[0047] A. Computing and Network Environment

[0048] Before discussing specific embodiments of the present solution, it may be helpful to describe aspects of the operating environment and associated system components (eg, hardware elements) in conjunction with the methods and systems described herein. Figure 1A, depicting an embodiment of a network environment. In brief overview, the network environment includes a wireless communication system that includes one or more access points (APs) or network devices 106, one or more client devices (e.g., STAs) or wireless communication devices 102, and network hardware components or network hardware 192. For example, the wireless communication device 102 may include a laptop computer, a tablet computer, a personal computer, and / or a cellular telephone device. Reference Figure 1B and 1C The details of the embodiments of each station or wireless communication device 102 and AP or network device 106 are described in more detail. In one embodiment, the network environment may be a temporary network environment, an infrastructure wireless network environment, a subnet environment, etc. The network device 106 or AP may be operably coupled to the network hardware 192 via a local area network connection. In some embodiments, the network device 106 is a 5G base station. The network hardware 192, which may include routers, gateways, switches, bridges, modems, system controllers, appliances, etc., may provide a local area network connection for the communication system. Each of the network devices 106 or APs may have an associated antenna or antenna array to communicate with the wireless communication devices in its area. The wireless communication device 102 may register with a specific network device 106 or AP to receive services from the communication system (e.g., via SU-MIMO or MU-MIMO configuration). For direct connections (e.g., point-to-point communications), some wireless communication devices may communicate directly via allocated channels and communication protocols. Some of the wireless communication devices in the wireless communication device 102 may be mobile or relatively static relative to the network device 106 or AP.

[0049] In some embodiments, the network device 106 or AP includes a device or module (including a combination of hardware and software) that allows the wireless communication device 102 to connect to a wired network using wireless fidelity (WiFi) or other standards. The network device 106 or AP may sometimes be referred to as a wireless access point (WAP). The network device 106 or AP may be implemented (e.g., configured, designed and / or constructed) for operation in a wireless local area network (WLAN). In some embodiments, the network device 106 or AP may be connected to a router (e.g., via a wired network) as a stand-alone device. In other embodiments, the network device 106 or AP may be a component of a router. The network device 106 or AP may provide access to a network for multiple devices. For example, the network device 106 or AP may be connected to a wired Ethernet connection and use a radio frequency link to provide a wireless connection so that other devices 102 utilize the wired connection. The network device 106 or AP may be implemented to support standards for sending and receiving data using one or more radio frequencies. Those standards and the frequencies they use may be defined by IEEE (e.g., IEEE 802.11 standards). The network device 106 or AP may be configured and / or used to support public Internet hotspots and / or extend the Wi-Fi signal range of the network over the network.

[0050] In some embodiments, the access point or network device 106 may be used for a wireless network (e.g., IEEE 802.11, Bluetooth, ZigBee, any other type of radio frequency-based network protocol, and / or variations thereof) (e.g., in a home, in a vehicle, or in a building). Each of the wireless communication devices 102 may include a built-in radio and / or be coupled to a radio. Such wireless communication devices 102 and / or access points or network devices 106 may operate in accordance with various aspects of the disclosure presented herein to enhance performance, reduce cost and / or size, and / or enhance broadband applications. Each wireless communication device 102 may have the ability to act as a client node seeking access to resources (e.g., data, and connections to network nodes such as servers) via one or more access points or network devices 106.

[0051] The network connection may include any type and / or form of network and may include any of the following: a point-to-point network, a broadcast network, a telecommunications network, a data communications network, a computer network. The topology of the network may be a bus, star, or ring network topology. The network may be any such network topology known to those of ordinary skill in the art that is capable of supporting the operations described herein. In some embodiments, different types of data may be transmitted via different protocols. In other embodiments, the same type of data may be transmitted via different protocols.

[0052] The communication device 102 and the access point or network device 106 may be deployed as and / or executed on any type and form of computing device, such as a computer, network device, or appliance capable of communicating over any type and form of network and performing the operations described herein. Figure 1B and 1C A block diagram of a computing device 100 suitable for practicing embodiments of a wireless communication device 102 or a network device 106 is depicted. Figure 1B and 1C As shown in FIG. 1 , each computing device 100 includes a processor 121 (eg, a central processing unit) and a main memory unit 122. Figure 1B As shown in FIG. 1 , computing device 100 may include storage device 128, installation device 116, network interface 118, I / O controller 123, display devices 124a to 124n, keyboard 126, and pointer device 127 (e.g., mouse). Storage device 128 may include an operating system and / or software. Figure 1C As shown in , each computing device 100 may also include additional optional elements that communicate with the central processing unit or processor 121, such as a memory port 103, a bridge 170, one or more input / output devices 130a to 130n, and a cache memory 140.

[0053] The central processing unit or processor 121 is any logic circuitry that responds to and processes instructions fetched from the main memory unit 122. In many embodiments, the central processing unit or processor 121 is provided by a microprocessor unit, such as those manufactured by Intel Corporation of Santa Clara, California; by International Business Machines of White Plains, New York; or by Advanced Micro Devices of Sunnyvale, California. The computing device 100 may be based on any of these processors or any other processor capable of operating as described herein.

[0054] The main memory unit 122 may be one or more memory chips capable of storing data and allowing the microprocessor or processor 121 to directly access any storage location, such as any type or variant of static random access memory (SRAM), dynamic random access memory (DRAM), ferroelectric RAM (FRAM), NAND flash memory, NOR flash memory, and solid-state drive (SSD). The main memory unit 122 may be based on any of the memory chips described above or any other available memory chip capable of operating as described herein. Figure 1B In the embodiment shown in , processor 121 communicates with main memory unit 122 via system bus 150 (described in more detail below). Figure 1C An embodiment of the computing device 100 is depicted in which the processor communicates directly with the main memory unit 122 via the memory port 103. For example, in Figure 1C In the embodiment, the main memory unit 122 may be a DRDRAM.

[0055] Figure 1C An embodiment is depicted in which the main processor 121 communicates directly with the cache memory 140 via an auxiliary bus (sometimes referred to as a backside bus). In other embodiments, the main processor 121 communicates with the cache memory 140 using the system bus 150. The cache memory 140 typically has a faster response time than the main memory unit 122 and is provided by, for example, SRAM, BSRAM, or EDRAM. Figure 1C , the processor 121 communicates with various I / O devices 130 via a local system bus (e.g., system bus 150). Various buses may be used to connect the central processing unit or processor 121 to any of the I / O devices 130, such as a VESA VL bus, an ISA bus, an EISA bus, a Micro Channel Architecture (MCA) bus, a PCI bus, a PCI-X bus, a PCI Express bus, or a NuBus. For embodiments in which the I / O device is a video display 124, the processor 121 may communicate with the display 124 using an Advanced Graphics Port (AGP). Figure 1C An embodiment of a computer or computer system 100 is depicted in which the main processor 121 can communicate directly with the I / O device 130b, such as via HYPERTRANSPORT, RAPIDIO, or INFINIBAND communication techniques. Figure 1C Also depicted is an embodiment in which local buses are mixed with direct communications: processor 121 communicates with I / O device 130a using a local interconnect bus while communicating directly with I / O device 130b.

[0056] A variety of I / O devices 130a to 130n may be present in the computing device 100. Input devices include keyboards, mice, track pads, track balls, microphones, dials, touch pads, touch screens, and drawing tablets. Output devices include video displays, speakers, inkjet printers, laser printers, projectors, and dye sublimation printers. Figure 1B , the I / O devices may be controlled by an I / O controller 123. The I / O controller may control one or more I / O devices, such as a keyboard 126 and a pointer device 127, such as a mouse or light pen. In addition, the I / O devices may also provide storage and / or installation media for the computing device 100. In yet other embodiments, the computing device 100 may provide a USB connection (not shown) to receive a handheld USB storage device, such as the USB flash drive series of devices manufactured by Twintech Industry, Inc. of Los Alamitos, California.

[0057] Reference again Figure 1B , the computing device 100 may support any suitable installation device 116, such as a disk drive, a CD-ROM drive, a CD-R / RW drive, a DVD-ROM drive, a flash memory drive, a tape drive in various formats, a USB device, a hard drive, a network interface, or any other device suitable for installing software and programs. The computing device 100 may further include a storage device, such as one or more hard drives or a redundant array of independent disks, for storing an operating system and other related software, and for storing application software programs (such as any program or software 120 used to implement (e.g., configured and / or designed for) the systems and methods described herein). Optionally, any of the installation devices 116 may also be used as a storage device. In addition, the operating system and software may be run from a bootable media.

[0058] In addition, the computing device 100 may include a network interface 118 that interfaces to a network through various connections, including but not limited to a standard telephone line, a LAN or WAN link (e.g., 802.11, T1, T3, 56kb, X.25, SNA, DECNET), a broadband connection (e.g., ISDN, Frame Relay, ATM, Gigabit Ethernet, Ethernet over SONET), a wireless connection, or some combination of any or all of the above. The connection may be established using various communication protocols (e.g., TCP / IP, IPX, SPX, NetBIOS, Ethernet, ARCNET, SONET, SDH, Fiber Distributed Data Interface (FDDI), RS232, IEEE 802.11, IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, IEEE 802.11ac, IEEE 802.11ad, CDMA, GSM, WiMax, and direct asynchronous connection). In one embodiment, computing device 100 communicates with other computing devices 100' via any type and / or form of gateway or tunneling protocol, such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS). Network interface 118 may include a built-in network adapter, a network interface card, a PCMCIA network card, a card bus network adapter, a wireless network adapter, a USB network adapter, a modem, or any other device suitable for interfacing computing device 100 to any type of network capable of communicating and performing the operations described herein.

[0059] In some embodiments, the computing device 100 may include or be connected to one or more display devices 124a to 124n. Thus, any one of the I / O devices 130a to 130n and / or the I / O controller 123 may include any type and / or form of suitable hardware, software, or a combination of hardware and software to support, enable, or provide the computing device 100 with connection and use of the display devices 124a to 124n. For example, the computing device 100 may include any type and / or form of video adapters, video cards, drivers, and / or libraries for interfacing, communicating, connecting, or otherwise using the display devices 124a to 124n. In one embodiment, the video adapter may include multiple connectors for interfacing to the display devices 124a to 124n. In other embodiments, the computing device 100 may include multiple video adapters, each of which is connected to the display devices 124a to 124n. In some embodiments, any part of the operating system of the computing device 100 may be configured to use multiple display devices 124a to 24n. In other embodiments, the I / O device 130 may be a bridge between the system bus 150 and an external communication bus, such as a USB bus, an Apple desktop bus, an RS-232 serial connection, a SCSI bus, a FireWire bus, a FireWire 800 bus, an Ethernet bus, an AppleTalk bus, a Gigabit Ethernet bus, an asynchronous transfer mode bus, a Fibre Channel bus, a fiber optic bus, a serial attached small computer system interface bus, a USB connection, or an HDMI bus.

[0060] Figure 1B and 1CA computing device 100 of the type depicted in the drawings may operate under the control of an operating system that controls the scheduling of tasks and access to system resources. The computing device 100 may run any operating system, such as any of the following: versions of the MICROSOFT WINDOWS operating system, different versions of the Unix and Linux operating systems, any version of the MAC OS for Macintosh computers, any embedded operating system, any real-time operating system, any open source operating system, any proprietary operating system, any operating system for mobile computing devices, or any other operating system capable of running on a computing device and performing the operations described herein. Typical operating systems include, but are not limited to, Android produced by Google Inc., WINDOWS 7, 8 and 10 produced by Microsoft Corporation of Redmond, Washington, MAC OS produced by Apple Computer, Inc. of Cupertino, California, WebOS produced by Research In Motion (RIM), OS / 2 produced by International Business Machines Corporation of Armonk, New York, and the freely available Linux operating system released by Caldera Corp. of Salt Lake City, Utah, or any type and / or form of Unix operating system, as well as other operating systems.

[0061] The computer system or computing device 100 may be any workstation, phone, desktop computer, laptop or notebook computer, server, handheld computer, mobile phone or other portable telecommunication device, media playback device, gaming system, mobile computing device, or any other type and / or form of computing device, telecommunication device, or media device capable of communication. In some embodiments, the computing device 100 may have a different processor, operating system, and input device consistent with the device. For example, in one embodiment, the computing device 100 is a smart phone, mobile device, tablet computer, or personal digital assistant. In addition, the computing device 100 may be any workstation, desktop computer, laptop or notebook computer, server, handheld computer, mobile phone, any other computer or other form of computing device or telecommunication device capable of communication and having sufficient processor power and memory capacity to perform the operations described herein.

[0062] Aspects of the operating environment and components described above will be apparent in the context of the systems and methods disclosed herein.

[0063] B. Protocols for Detection / Response Operations and Methods and Apparatus for Using Such Protocols

[0064] Disclosed herein are systems and methods that can be used in any communication system including but not limited to Wi-Fi and LTE networks. The systems and methods can be used with an AP or a STA in, for example, a reference Figure 1A Although embodiments of the probe / response operation for communicating in accordance with the IEEE 802.11 standard are described herein, the systems and methods may be used with other networks, such as cellular networks and satellite networks, and in point-to-point communications.

[0065] refer to Figure 2A , the wireless communication network or system 200 includes client devices or STAs 204, 206, 208, and 224 and APs 212, 214, 216, and 222. The STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222 may be referred to in the accompanying drawings. Figure 1A C. Any number of STAs 204, 206, 208, and 224 and APs 212, 214, 216, and 222 may be used in the network or system 200. In some embodiments, a STA or client device may refer to any device for communicating in a communication system and includes, but is not limited to, a fixed laptop, a portable laptop, or a mobile laptop, a desktop personal computer, a personal digital assistant, a workstation, a wearable device, a smart phone, or a Wi-Fi phone. In some embodiments, an access point or AP may refer to a device for communicatively coupling one or more non-AP devices (e.g., client devices or STAs) to a network. In some embodiments, an AP may enable non-AP devices to connect and communicate with a network. In some embodiments, an AP is a wireless access point (WAP) configured to enable wireless communication between non-AP devices. APs include, but are not limited to, mobile hotspots, portable hotspots, or fixed hotspots, routers, bridges, gNB nodes, eNodeBs, evolved NodeBs, or other communication devices. An AP may provide services for a STA, for example, acting as a connection point to another network.

[0066] STA 204, 206, 208 and 224 and AP 212, 214, 216 and 222 may each include a wireless transceiver and various modules for communicating via a connection. The modules may be software (e.g., firmware), hardware components, and combinations thereof. In some embodiments, each of STA 204, 206, 208 and 224 and AP 212, 214, 216 and 222 includes a media access control (MAC) layer circuit and a physical (PHY) layer interface to a wireless medium that complies with IEEE 802.11 and may be part of a larger device or system. In some embodiments, each of STA 204, 206, 208 and 224 and AP 212, 214, 216 and 222 operates according to a standard other than the IEEE 802.11 standard.

[0067] After the authentication and association operations, a connection for wireless communication may be established between at least one of the STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222. For example, the STA 208 connects 218 with the AP 212. The STAs 204, 206, 208, and 224 each include circuitry (e.g., a processor or processing circuit 221), and the APs 212, 214, 216, and 222 each include circuitry (e.g., processing circuit 233) for establishing and canceling the connection 218 and for transferring data across the connection. In another example, the STA 204 connects 228 with the AP 212, and the STA 206 connects 229 with the AP 222. STAs 204, 206, 208, and 224 each include circuitry (e.g., a processor or processing circuitry 221), and APs 212, 214, 216, and 222 each include circuitry (e.g., processing circuitry 233) for operating in accordance with probe and probe response operations, as described below. In some embodiments, connections 218, 228, 229, and 226 are wireless connections that are formed using association and / or authorization operations and canceled using disassociation and / or deauthentication operations. In some embodiments, connections 218, 228, 229, and 226 may be single-link, multi-link, or dual-link connections associated with APs 212 and 222 and may be secure connections (e.g., using encryption). In some embodiments, connections 218, 228, 229, and 226 provide data communications and control and management communications in 5G, 6G, 60G, or 2G bands on one or more channels.

[0068] refer to Figure 2B According to some embodiments, the device 220 is the AP 212 or the STA 208 ( Figure 2A) and is configured for a secure probe request / response protocol. In some embodiments, device 220 includes processing circuitry 230 and a probe request / response module 238. In some embodiments, the term probe response module may refer to a module that processes a probe request message. In some embodiments, processing circuitry 230 is any circuit system or component that can perform logic and communication processing operations and may include a processor 234 and a memory 236.

[0069] In some embodiments, the processing circuit 230 is implemented as a field programmable gate array, an application specific integrated circuit, hardware, software executing a processor, or a state machine. In some embodiments, the processing circuit 230 is part of a layer (e.g., MAC layer, network layer, PHY layer) of an IEEE 802.11 standard device. In some embodiments, the processing circuit 230 may be configured to perform communication operations, frame construction and processing, probe request and response operations, discovery operations, association operations, authorization operations, connection setup, disconnection operations, handover operations, and deauthentication operations. In some embodiments, the instructions of the processing circuit 230 are stored in a non-transitory medium such as a memory 236. In some embodiments, the processing circuit 221 of the STA 208 and the processing circuit 233 of the AP 212 are similar to the processing circuit 230.

[0070] The memory 236 may be one or more devices (e.g., RAM, ROM, flash memory, hard disk storage) for storing data and / or computer code used to complete and / or facilitate the various process steps described herein. The memory 236 may be or include non-transitory volatile memory, non-volatile memory, and non-temporary computer storage media. The memory 236 may include database components, object code components, script components, or any other type of information structure used to support various activities and the information structures described in the present invention. The memory 236 may be communicatively coupled to the processor 234 and include computer code or instructions for executing one or more process steps described herein. The processor 234 may be implemented as one or more application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), a group of processing components, software that executes the processor, a state machine, or other suitable electronic processing components. In this way, the AP, STA, or network device 106 ( Figure 1A ) is configured to execute various modules and / or programs and store associated data in a database of the memory 236. The modules (e.g., module 238) may be implemented in AP software (e.g., MAC layer or PHY layer software) or STA software (e.g., MAC layer or PHY layer software). In some embodiments, the AP 212 or the STA 208 ( Figure 2A) is structured and used to establish connections and transfer access rights to other computing systems and devices (e.g., wireless communication device 102, network hardware 192, other access points or network devices 106) via a network (e.g., WAN connection, LAN connection, WLAN connection, etc.). Figure 1A to C)).

[0071] In some embodiments, the probe / response module 238 is configured to provide or process a probe message or a probe response message. For example, the probe / response module 238 is configured to cause the device 220 to provide a probe request message and / or a probe response message for a secure exchange. In some embodiments, the probe / response module 238 is configured to cause the device 220 to provide a probe request message and / or a probe response message for a secure exchange between the AP 212 and the STA 208 ( Figure 2A ) to perform a security exchange between the AP 212 and the STA 208, the security exchange supplementing the beacon protection and / or being used to reestablish the AP 212 and the STA 208 using less connection time ( Figure 2A ). In some embodiments, the probe / response module 238 is configured to implement a secure probe exchange (SPX) introduced by management frame protection (MFP) of individually addressed / unicast probe request messages (e.g., frames) and unicast probe response messages (e.g., frames). If the probe request / response frames are secure, the information present in the probe response frames is generally reliable and the non-AP STA can consider updating the AP's capabilities based on the secure probe response without causing a security vulnerability.

[0072] The discovery operation of an AP (e.g., AP 212) or the continued presence of an AP is detected through a beacon message or a probe request / probe response exchange. The beacon message is provided using beacon protection. The probe / response module 238 is configured to cause the device 220 to provide a secure probe request / response frame in a network with beacon protection enabled by handling broadcast probe requests during directed association, handling protected unicast probe requests, handling unprotected unicast probe requests, establishing a connection between an AP and a STA with reduced connection time, and handling unprotected unicast probe requests.

[0073] refer to Figure 3 , detection / response module 238 ( Figure 2B) handles broadcast probe request / response operations between AP 212 and STA 208. In some embodiments, STA 208 and AP 212 support beacon protection. STA 208 and AP 212 perform process 300 to handle broadcast probe request frames using a secure probe request / response protocol. When an active scan is issued at operation 302, STA 208 provides a broadcast probe request frame. In operation 304, AP 212 with beacon protection enabled responds to the broadcast probe request frame by providing an unprotected (without management frame protection (MFP)) unicast probe response frame. In some embodiments, an unprotected probe response frame for a broadcast probe request frame is sent regardless of whether STA 208 is associated or unassociated with AP 212. At operation 306, the association is completed. At operation 307, AP 212 provides a beacon frame in operation 307. The beacon frame includes an information element (IE) or a management MIC element (MME) for a management message integrity code (MIC). The four-way handshake is completed at operation 308 and the connection between STA 208 and AP 212 is completed. In operations 310a to n, a beacon frame may be provided using the MME after the connection is established. In operation 314, an unprotected broadcast probe request frame may be provided to AP 212, and in operation 316, an unprotected unicast probe response frame may be provided to STA 208 in response to the unprotected broadcast probe request frame. The unprotected unicast probe response frame is provided in operation 316 regardless of whether STA 208 is associated or not associated with AP 212.

[0074] refer to Figure 4 , detection / response module 238 ( Figure 2B ) handles unicast probe request / response operations between AP 212 and STA 208. In some embodiments, STA 208 and AP 212 support beacon protection. In some embodiments, unicast probe request / response operations between AP 212 and STA 208 are handled using protected individually addressed / unicast probe requests to ensure the integrity of the association between an AP with beacon protection enabled and a STA supporting beacon protection. In some embodiments, STA 208 and AP 212 perform flow 400 to handle unicast probe request frames using a secure probe request / response protocol.

[0075] When issuing an active scan at operation 302, STA 208 provides a broadcast probe request frame and uses reference flow 300 ( Figure 3 ) to establish a connection. In operations 310a to n, the MME may be used to provide a beacon frame after the connection is established.

[0076] In operation 414, a protected unicast probe request frame may be provided to the AP 212, and in operation 416, a protected unicast probe response frame may be provided to the STA 208. In operation 422, if there is any unprotected probe response for the corresponding protected probe request, the unprotected unicast probe response frame received by the STA 208 is discarded. In some embodiments, in operation 414, the STA 208 supporting the beacon protection feature sends an individually addressed protected probe request frame to the associated beacon protection enabled AP (e.g., AP 212). In some embodiments, in operation 416, the AP 212 sends a protected probe response to the STA 208 for the corresponding unicast protected probe request frame.

[0077] refer to Figure 5 , detection / response module 238 ( Figure 2B ) handles unprotected unicast probe request / response operations between AP 212 and STA 208. In some embodiments, STA 208 and AP 212 support beacon protection. In some embodiments, unicast probe request / response operations between AP 212 and STA 208 are handled using unprotected individually addressed / unicast probe requests to ensure the integrity of the association between an AP with beacon protection enabled and a STA supporting beacon protection. In some embodiments, STA 208 and AP 212 perform flow 500 to handle unprotected unicast probe request frames using a secure probe request / response protocol.

[0078] When issuing an active scan at operation 302, STA 208 provides a broadcast probe request frame and uses reference flow 300 ( Figure 3 ) to establish a connection. In operations 310a to n, the MME may be used to provide a beacon frame after the connection is established.

[0079] In some embodiments, in operation 514, an unprotected unicast probe request frame is provided to AP 212 from a source (e.g., an attacker). In operation 516, in response to the unprotected unicast probe request frame sent in operation 514, AP 212 provides a security association (SA) query request frame to ensure that STA 208 is securely associated. In operation 518, in response to the SA query request frame sent in operation 516, AP 212 receives an SA query response frame to ensure that STA 208 is securely associated. Upon receiving the SA query response from STA 208, AP 212 discards the unprotected probe request from operation 514 because STA 208 has the appropriate key information to send a protected unicast probe request. The unprotected probe request frame from operation 514 is discarded because AP 212 has determined that the unprotected probe request frame from operation 514 is not from a legitimate associated STA that supports beacon protection.

[0080] refer to Figure 6 , detection / response module 238 ( Figure 2B ) handles reestablishing the connection between AP 212 and STA 208. In some embodiments, the connection is established using a directed association. In some embodiments, STA 208 and AP 212 perform flow 500 to handle unprotected individually addressed / unicast probe requests to handle the association with STA 208 after a new restart / refresh.

[0081] At operation 306, the association is completed. At operation 307, the AP 212 provides a beacon frame in operation 307. The beacon frame contains an information element (IE) or a management MIC element (MME) for a management message integrity code (MIC). The four-way handshake is completed at operation 308 and the connection between the STA 208 and the AP 212 is completed. In operations 310a to n, the beacon frame may be provided using the MME after the connection is established.

[0082] At operation 612, a restart or refresh is provided. In some embodiments, a restart or refresh of the wifi interface of the STA 208 supporting beacon protection may cause the key information that was once exchanged to become invalid after the restart / refresh. In some embodiments, the AP 212 still retains information with the old key value of the STA 208. A new association request specifically directed from the STA 208 to associate with a previously associated AP (e.g., AP 212) may be rejected by the AP because the STA information already exists. The association may be delayed until the life span interval expires on the AP side to clean up the old associated STA information. In some embodiments, when the AP 212 is not aware of the restart or refresh of the STA 208 and still retains the old security key exchange value associated with the STA 208, this delay is advantageously reduced by following the process 600 to overcome the delay in reestablishing a new connection.

[0083] In some embodiments, in operation 614, an unprotected unicast probe request frame is provided from the STA 208 to the AP 212. In response to the unprotected unicast probe request frame sent in operation 614, in operation 615, the AP 212 provides an SA query request frame to ensure that the STA 208 is securely associated. In some embodiments, the unprotected unicast probe request sent from the associated STA 208 triggers the SA query request frame from the AP 212.

[0084] After the SA query request frame is sent in operation 615, an SA query response timeout occurs in operation 616. The SA query timeout occurs because STA 208 does not have the appropriate key information to respond to the SA query response frame. After the timeout expires at the AP end, AP 212 clears the previous association information associated with STA 208 and sends an unprotected probe response frame to STA 208 in operation 618 to establish a new association. Once the probe response frame is received from AP 212, STA 208 continues the (re)association process steps. Using process 600, AP and STA association occurs more quickly without the need to reject the association request from STA 208.

[0085] The association or re-association is completed in operation 622. The four-way handshake is completed at operation 626 and the connection or re-connection between the STA 208 and the AP 212 is completed. In operation 628, a beacon frame may be provided using the MME after the connection is established.

[0086] It should be noted that certain paragraphs of the present disclosure may refer to terms such as "first" and "second" in conjunction with subgroups of frames, responses, and devices for the purpose of identifying or distinguishing one from another or others. These terms are not intended to relate entities (e.g., first and second devices) only in time or according to a sequence, although in some cases, these entities may include such a relationship. These terms also do not limit the number of possible entities (e.g., STAs, APs, beam formers, and / or beamformees) that can operate within a system or environment. It should be understood that the system described above may provide multiple of any one or each of those components, and these components may be provided on a stand-alone machine or (in some embodiments) on multiple machines in a distributed system. Further, bit field positions may be changed and multi-bit words may be used. In addition, the systems and methods described above may be provided as one or more computer-readable programs or executable instructions embodied on or in one or more articles of manufacture (e.g., floppy disks, hard disks, CD-ROMs, flash memory cards, PROMs, RAMs, ROMs, or tapes). The program may be implemented in any programming language such as LISP, PERL, C, C++, C#, etc. or in any byte code language such as JAVA, etc. The software program or executable instructions may be stored as object code on or in one or more articles of manufacture. A circuit system may refer to any electronic circuit or circuits.

[0087] Circuitry or circuitry may refer to any electronic circuit or combination of circuits. To the extent that a device, circuit, processor, or circuitry is described or recited in a claim as performing one or more operations or functions or being configured to perform one or more operations or functions, the performance of the recited functions or operations may be distributed across two or more devices, circuits, or processors without departing from the scope of the claims unless those functions or operations are expressly recited as being performed on a particular single circuit or group of circuits, processors, or devices (e.g., using the phrases "on a single circuit," "on a group of circuits comprising," or "on a single device").

[0088] Although the foregoing written description of the methods and systems enables one of ordinary skill in the art to make and use embodiments thereof, one of ordinary skill in the art should understand and appreciate variations, combinations, and equivalents of the specific embodiments, methods, and examples presented herein. For example, the specific values ​​of bandwidth, channels, and sub-bands discussed above are exemplary. Therefore, the present methods and systems should not be limited by the embodiments, methods, and examples described above, but rather by all embodiments and methods within the scope and spirit of the present disclosure.

Claims

1. A first device, comprising: Circuitry configured to provide at least one frame to the second device across the connection in response to the unprotected broadcast probe request message, the frame including an unprotected unicast probe response message.

2. The first device of claim 1, wherein the frame is provided according to an 802.11 protocol and the connection is established by using an association or authentication operation. The first device of claim 1 , wherein the first device is an access point with beacon protection enabled. 4 . The first device of claim 1 , wherein the circuit is configured to provide a protected unicast probe response message to the second device across the connection in response to a protected unicast probe request message. The first device according to claim 1 , wherein the second device is a station device supporting beacon protection.

6. The first device of claim 1, wherein the circuit is configured to provide a security association query request message in response to an unprotected unicast probe request message from another source.

7. The first device of claim 6, wherein the circuit is configured to provide an unprotected unicast probe response message in response to expiration of a timeout period after the security association query request message is sent out.

8. The first device of claim 1, wherein the circuit is configured to provide an unprotected unicast probe response message in response to expiration of a timeout period after a security association query request message is sent out.

9. A first device, comprising: Circuitry configured to provide at least one frame to the second device across the connection in response to the protected unicast probe request message, the frame including the protected unicast probe response message.

10. The first device of claim 9, wherein the frame is provided according to an 802.11 protocol and the connection is established using an association or authentication operation, and wherein the first device is a beacon protection enabled access point.

11. The first device of claim 10, wherein the circuit is configured to provide an unprotected unicast probe response message to the second device across the connection in response to an unprotected broadcast probe request message.

12. A first device according to claim 10, wherein the circuit is configured to provide a security association query request message in response to an unprotected unicast probe request message, and wherein the circuit is configured to provide an unprotected unicast probe response message in response to expiration of a timeout period after the security association query request message is sent.

13. A first device, comprising: Circuitry configured to provide at least one frame to a second device across a connection, the frame comprising a protected unicast probe request message, wherein the circuitry is configured to discard an unprotected unicast message provided after receiving a protected unicast probe response message from the second device in response to the protected unicast probe request message. The first device according to claim 13 , wherein the first device is a station device supporting beacon protection.

15. A method comprising: establishing a connection between the first device and the second device; providing an unprotected broadcast probe request message from the first device to the second device across the connection; and An unprotected unicast probe response message is received at the first device from the second device, wherein the first device is a station device that supports beacon protection and the second device is an access point with beacon protection enabled.

16. The method according to claim 15, further comprising: providing a protected unicast probe request message from the first device to the second device across the connection; and A protected unicast probe response message is received at the first device from the second device.

17. The method according to claim 16, further comprising: An unprotected unicast probe response message is discarded at the first device for the protected unicast probe request message sent from the first device.

18. The method of claim 15, further comprising: providing an unprotected broadcast probe request message from the first device to the second device across the connection; and An unprotected unicast probe response message is received at the first device from the second device.

19. The method of claim 15, further comprising: receiving, at the second device, an unprotected unicast probe request message; and A security association query request is provided from the second device to the first device to receive a security association query response and to forgo sending the unicast probe response message.

20. The method of claim 15, further comprising: resetting / restarting / refreshing the first device without any disconnection request from the first device; reestablishing a connection between the first device and the second device after a reset / restart / refresh; providing an unprotected unicast probe request message from the first device to the second device across the connection; and Initiating a security association query request from the second device and immediately after a timeout, sending an unprotected unicast probe response message to the first device; and An unprotected unicast probe response message is received at the first device from the second device to continue the connection reestablishment, wherein the first device is a station device supporting beacon protection and the second device is a beacon protection enabled access point.

Images