System and method for re-association in network

Abstract

The invention relates to a system and method for re-association in a network. Systems and methods use a protocol for secure re-association exchange. A first device may be used in the switch and include circuitry configured to provide at least one frame to a second device. The frame includes a protected re-association request message. Alternatively, the frame may contain a protected re-association response message.

Description

Technical Field

[0001] The present disclosure generally relates to systems and methods for communication between an access point (AP) and a client device (e.g., a station (STA)) or other communication devices. In some embodiments, the present disclosure generally relates to systems and methods related to reassociation operations and / or messages therefor, including but not limited to messages used in a secure or protected reassociation protocol. Background Art

[0002] Over the past few decades, the wireless communication device market has grown by orders of magnitude driven by the use of portable devices and the increase in connectivity and data transfer between a wide variety of devices. Digital switching technology has facilitated the large-scale deployment of inexpensive, easy-to-use wireless communication networks. In addition, improvements in digital and radio frequency (RF) circuit manufacturing and advances in circuit integration and other aspects have made wireless devices smaller, cheaper and more reliable. Wireless communications can operate according to various standards such as IEEE802.11x, Bluetooth, Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), etc. With the development of higher data throughput and other changes, newer standards are being developed for adoption, such as the progress from IEEE 802.11n to IEEE802.11ac.

[0003] Establishing a connection for communication between an access point (AP) and a client device (e.g., a station (STA)) or other communication devices may involve the exchange of several messages. A connection may be reestablished after it has been terminated. The protocol for reestablishing a connection may increase communication overhead and may provide opportunities for security vulnerabilities. Summary of the invention

[0004] In one aspect, the disclosure relates to a first device comprising circuitry configured to provide at least one frame to a second device, the frame comprising a protected reassociation request message.

[0005]

[0011] In another aspect, the disclosure relates to a first device comprising circuitry configured to provide at least one frame to a second device in response to a protected reassociation request message, the frame comprising a protected reassociation response message.

[0006] In yet another aspect, the present disclosure relates to a method of operating a first device, the first device being connected to a second device, the connection having associated key information, the method comprising: after an event affecting the connection, providing a protected reassociation request message from the first device to the second device across the connection using the key information; and receiving a protected reassociation response message from the second device using the key information at the first device. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Various objects, aspects, features and advantages of the present disclosure will become more apparent and better understood by referring to the detailed description in conjunction with the accompanying drawings, wherein like reference characters identify corresponding elements throughout the drawings. In the drawings, like reference numerals generally indicate identical, functionally similar and / or structurally similar elements.

[0008] Figure 1A is a block diagram depicting a network environment including one or more access points (APs) in communication with one or more devices or stations (STAs) according to some embodiments.

[0009] Figure 1B and 1C is a block diagram depicting a computing device suitable for use in conjunction with the methods and systems described herein, according to some embodiments.

[0010] Figure 2A is a block diagram depicting a network including APs and STAs according to some embodiments.

[0011] Figure 2B According to some embodiments Figure 2A A more detailed block diagram of an AP or STA of a network configured for reassociation operation is illustrated in FIG.

[0012] Figure 3 is a diagram illustrating some embodiments of the Figure 2B Flowchart of the reassociation operation of an AP or STA illustrated in FIG.

[0013] Figure 4 is a diagram illustrating a method for Figure 2B 0036] A general block diagram of a reassociation response message of an AP or a STA is illustrated in FIG.

[0014] The details of various embodiments of the method and system are set forth in the accompanying drawings and the description below. DETAILED DESCRIPTION

[0015] The following IEEE standards (including any draft versions of such standards) are hereby incorporated by reference in their entirety and made a part of this disclosure for all purposes: WiFi Alliance standards and IEEE 802.11 standards, including but not limited to IEEE 802.11a TM 、IEEE 802.11b TM 、IEEE 802.11g TM 、IEEE 802.11be TM 、IEEEP802.11n TM ;IEEE P802.11ax TM; and IEEE P802.11ac TM Although the present disclosure may refer to aspects of these standards, the present disclosure is in no way limited to these standards.

[0016] For the purpose of reading the following description of various embodiments, the following description of the various sections of this specification and their corresponding contents may be helpful:

[0017] - Section A describes a network environment and a computing environment that may be suitable for practicing the embodiments described herein; and

[0018] - Section B describes a protocol for data request / response operations and embodiments of methods and apparatus using such a protocol.

[0019] Some embodiments disclosed herein relate to protocols for secure reassociation exchanges between previously connected clients and APs. In some embodiments, protocols are provided for WiFi networks (e.g., IEEE 802.11 networks, etc.), cellular networks, point-to-point communications, or a combination thereof. In some embodiments, the protocols may be used with Wi-Fi APs to enhance connection security and reduce the time to reestablish a connection. In some embodiments, devices that support protected management frames and beacon protection capabilities utilize the protocols. In some embodiments, systems and methods provide protected management frames (e.g., protected or secure reassociation request and / or response frames) for reassociation. In some embodiments, a WiFi network may refer to a wireless network with Internet access. In some embodiments, a cellular network may refer to a radio network distributed over land through cells, each of which includes a transceiver (e.g., a node or base station).

[0020] In some embodiments, the systems and methods use the protocol to reestablish the connection between the AP and the STA in a secure manner, thereby reducing the connection time. In some embodiments, the protected reassociation request / response frame can be used for the client's reassociation attempt for any purpose (e.g., to update its configuration, after roaming, after being out of range, after a WiFi off / on cycle, reboot, restart, or other events). In some embodiments, the systems and methods reduce the time required to onboard a homecoming client to an existing connected AP. The onboarding time may be related to a temporary rejection when completing a security association (SA) query check to distinguish between a true reassociation attempt and any kind of denial of service (DoS) attack from an intruder device that simulates the client's media access control (MAC) address. The onboarding time may also be related to the time it takes for the AP to terminate the existing client connection (which results in the removal of the higher network layer connection) before accepting a new reassociation request as a new connection. The onboarding time may also include a four-way handshake process to complete a secure connection.

[0021] Changing or updating the non-AP STA configuration may require re-association and includes, but is not limited to, the following scenarios: changing or modifying operational capabilities, such as modulation and coding scheme (MCS), number of spatial streams (NSS), bandwidth (BW), etc.; adding or removing links (e.g., in the case of 802.11be multi-link operation); and changing or modifying the derived keys (pairwise transient key (PTK), etc.) used for the connection of a STA or AP via an out-of-band (OOB) mechanism. In some embodiments, the systems and methods allow for temporary changes in configuration without requiring a new connection and teardown.

[0022] In some embodiments, the systems and methods are used in IEEE 802.11 infrastructure networks, but use protected reassociation request and response frame exchanges (e.g., secure reassociation or reconfiguration exchange (SRX)) under the protected management frame (PMF) category. In some embodiments, the systems and methods use association / reassociation request frames and association / reassociation response frames when the AP and client sides have valid keys for the connection (no teardown and new connection required).

[0023] In some embodiments, a connection may refer to a communication established between nodes for exchanging data according to a protocol (e.g., wireless communication between nodes). In some embodiments, a three-way or four-way handshake mechanism (via discovery, authentication, and association operations) is used to establish a connection. In some embodiments, a secure connection may refer to a connection that provides data in a format that is not easily available to the other party. Various methods can establish a secure connection, including but not limited to data encryption methods. In some embodiments, data encryption uses an algorithm for encrypting and decrypting information, including but not limited to: WPA and WPA2 operations in accordance with 802.11 standards (e.g., Temporal Key Integrity Protocol (TKIP) and Advanced Encryption Standard (AES)). A connection may be a wireless connection to or from a client device (e.g., STA) and an AP, or may be a connection between other types of communication devices. In some embodiments, a wireless network may be an 802.11 WiFi network (e.g., IEEE 802.11be). A client device or AP may be implemented in a device including one or more ICs packaged as an integrated circuit (IC) package.

[0024] An authentication operation may refer to the process of how a client device accesses a network. Authentication provides proof of identity to ensure that a client device or user is allowed to access the network. An association operation may refer to the process of associating an authenticated client device or user with an AP. Association allows the network to determine where to send data intended for the client device (e.g., sending data through the AP to which the client device is associated). Typically, a client device is associated with only a single AP. In some embodiments, disassociation may refer to a process in which a client device is no longer associated with an AP. In some embodiments, disassociation prevents the AP from continuing to attempt to transmit data to the client device after the connection is canceled. In some embodiments, disassociation typically involves sending a disassociation frame or message from the AP to the client device or from the client device to the AP. The client device may be disassociated from the AP while still maintaining authentication on the network. In some embodiments, deauthentication may refer to a process that does not allow any further services to be provided to the client device. In some embodiments, deauthentication typically involves sending a deauthentication frame or message from the AP to the client device or from the client device to the AP.

[0025] Some embodiments relate to a first device. The first device includes circuitry configured to provide at least one frame to a second device. The frame includes a protected reassociation request message.

[0026] In some embodiments, the frame is provided in accordance with an 802.11 protocol and the connection is reestablished using a reassociation operation. In some embodiments, the first device is a beacon protection enabled station (STA). In some embodiments, the circuit is configured to receive a protected reassociation response message from the second device. In some embodiments, the second device is an access point supporting beacon protection.

[0027] In some embodiments, the circuit is configured to receive a protected reassociation response message from the second device and provide a confirmation message in response to the protected reassociation response message. In some embodiments, the circuit is configured to provide the message with information about links for multi-link operation. In some embodiments, the information is for a reduced number of the links. In some embodiments, the information is related to a traffic identification to link mapping.

[0028] In some embodiments, a protected reassociation request message may refer to a message (e.g., a management frame) that requests reassociation and is encrypted or otherwise secured. In some embodiments, a protected reassociation request message may request a response containing information about the capabilities of one or more service set identifiers in the network to be sent and provided using key information provided during a four-way handshake associated with the connection. In some embodiments, a protected reassociation response message may refer to a message (e.g., a management frame) that responds to the reassociation request and is encrypted or otherwise secured. In some embodiments, a protected reassociation response message is similar to a protected reassociation request message and may include capability information, authentication information, etc. and confirmation of the reassociation. In some embodiments, a reassociation operation may refer to any operation in which a connection between two devices is reestablished after an event. In some embodiments, the event may refer to a restart or refresh of a wifi interface, a failed roaming attempt, a capability / parameter reconfiguration, a multi-link configuration change, or a situation in which a connection requires connection reestablishment. In some embodiments, a link may refer to a communication channel or frequency band used for communication between two devices. In some embodiments, the access point and the STA have the ability to transmit and receive data from the same service flow via multiple radio interfaces or multiple links. In some embodiments, multi-link operation may refer to any communication using more than one link. In some embodiments, confirmation message may refer to any message that provides an indication that data has been received and / or approved. In some embodiments, service identification to link mapping may refer to providing data that associates service identification or address with corresponding links.

[0029] Some embodiments relate to a first device. The first device includes circuitry configured to provide at least one frame to a second device in response to a protected reassociation request message. The frame includes a protected reassociation response message.

[0030] In some embodiments, the frame is provided in accordance with an 802.11 protocol and a connection is established using an association or authentication operation. The first device is an access point with beacon protection enabled. In some embodiments, the frame includes information confirming a re-association of a connection between the first device and the second device. In some embodiments, the circuit is configured to provide the frame if the second device is on a list of associated devices stored on the first device. In some embodiments, the circuit is configured not to provide the frame if the second device is not on a list of associated devices stored on the first device. In some embodiments, an associated device refers to a device that has been and / or remains associated with another device for a period of time according to an association operation.

[0031] Some embodiments are directed to a method of operating a first device. The first device is connected to a second device, and the connection has associated key information. The method includes providing a protected reassociation request message from the first device to the second device across the connection using the key information after an event affecting the connection. The method also includes receiving, at the first device, a protected reassociation response message from the second device using the key information. In some embodiments, the key information may refer to any data used to provide protected communications. The key information may be a Wired Equivalent Privacy (WEP) key used to encrypt frames (e.g., in an 802.11 network).

[0032] In some embodiments, the protected reassociation request message is a protected management frame. In some embodiments, the event comprises a failed roaming attempt, a capability / parameter reconfiguration, or a multi-link configuration change. In some embodiments, the protected reassociation response message from the second device is provided when the first device is on a list of associated devices stored on the second device. In some embodiments, the event is a change in multi-link configuration. In some embodiments, the event comprises roaming from the second device. In some embodiments, the change in multi-link configuration may refer to a change in parameters for multi-link communication operations.

[0033] In some embodiments, a frame may refer to a digital data transmission unit. For example, a frame may refer to a container for a single network data packet. In some embodiments, a data frame may refer to a frame containing data. In some embodiments, an encrypted frame may refer to a frame that has been encrypted. In some embodiments, a broadcast message or a broadcast frame may refer to a message or frame sent to more than one device in a BSS connected to an AP or communicating with an AP. In some embodiments, a broadcast message or a broadcast frame is sent to all devices in a BSS connected to an AP. In some embodiments, a unicast message or a unicast frame may refer to a message or frame with a single destination. A management frame may refer to a frame used for control or management operations, including but not limited to a beacon frame, a probe request / response frame, an authentication request / response frame, an association request / response frame, a deauthentication frame, a deassociation frame, a reassociation request frame, a reassociation response frame, etc. In some embodiments, a protected management frame may refer to a management frame configured to provide protection for unicast and multicast management actions. The frame may be protected from both eavesdropping and forgery, and may have mechanisms for privacy protection and increased resilience. Management frame protection (MFP) is a wireless feature that improves the security of management frames. The frames may be provided in accordance with wireless standard IEEE 802.11w-2009, which is intended to provide data confidentiality for management frames and protect wireless connectivity. In some embodiments, the management frame protection feature of STAs and APs may provide a set of information elements for frames that improve or ensure security.

[0034] A. Computing and Network Environment

[0035] Before discussing specific embodiments of the present solution, it may be helpful to describe aspects of the operating environment and associated system components (eg, hardware elements) in conjunction with the methods and systems described herein. Figure 1A , depicting an embodiment of a network environment. In brief overview, the network environment includes a wireless communication system that includes one or more access points (APs) or network devices 106, one or more client devices (e.g., STAs) or wireless communication devices 102, and network hardware components or network hardware 192. For example, the wireless communication device 102 may include a laptop computer, a tablet computer, a personal computer, and / or a cellular telephone device. Reference Figure 1B and 1CThe details of the embodiments of each station or wireless communication device 102 and AP or network device 106 are described in more detail. In one embodiment, the network environment may be a temporary network environment, an infrastructure wireless network environment, a subnet environment, etc. The network device 106 or AP may be operably coupled to the network hardware 192 via a local area network connection. In some embodiments, the network device 106 is a 5G base station. The network hardware 192, which may include routers, gateways, switches, bridges, modems, system controllers, appliances, etc., may provide a local area network connection for the communication system. Each of the network devices 106 or APs may have an associated antenna or antenna array to communicate with the wireless communication devices in its area. The wireless communication device 102 may register with a specific network device 106 or AP to receive services from the communication system (e.g., via SU-MIMO or MU-MIMO configuration). For direct connections (e.g., point-to-point communications), some wireless communication devices may communicate directly via allocated channels and communication protocols. Some of the wireless communication devices in the wireless communication device 102 may be mobile or relatively static relative to the network device 106 or AP.

[0036] In some embodiments, the network device 106 or AP includes a device or module (including a combination of hardware and software) that allows the wireless communication device 102 to connect to a wired network using wireless fidelity (WiFi) or other standards. The network device 106 or AP may sometimes be referred to as a wireless access point (WAP). The network device 106 or AP may be implemented (e.g., configured, designed and / or constructed) for operation in a wireless local area network (WLAN). In some embodiments, the network device 106 or AP may be connected to a router (e.g., via a wired network) as a stand-alone device. In other embodiments, the network device 106 or AP may be a component of a router. The network device 106 or AP may provide access to a network for multiple devices. For example, the network device 106 or AP may be connected to a wired Ethernet connection and use a radio frequency link to provide a wireless connection so that other devices 102 utilize the wired connection. The network device 106 or AP may be implemented to support standards for sending and receiving data using one or more radio frequencies. Those standards and the frequencies they use may be defined by IEEE (e.g., IEEE 802.11 standards). The network device 106 or AP may be configured and / or used to support public Internet hotspots and / or extend the Wi-Fi signal range of the network over the network.

[0037] In some embodiments, the access point or network device 106 may be used for a wireless network (e.g., IEEE 802.11, Bluetooth, ZigBee, any other type of radio frequency-based network protocol, and / or variations thereof) (e.g., in a home, in a vehicle, or in a building). Each of the wireless communication devices 102 may include a built-in radio and / or be coupled to a radio. Such wireless communication devices 102 and / or access points or network devices 106 may operate in accordance with various aspects of the disclosure presented herein to enhance performance, reduce cost and / or size, and / or enhance broadband applications. Each wireless communication device 102 may have the ability to act as a client node seeking access to resources (e.g., data, and connections to network nodes such as servers) via one or more access points or network devices 106.

[0038] The network connection may include any type and / or form of network and may include any of the following: a point-to-point network, a broadcast network, a telecommunications network, a data communications network, a computer network. The topology of the network may be a bus, star, or ring network topology. The network may be any such network topology known to those of ordinary skill in the art that is capable of supporting the operations described herein. In some embodiments, different types of data may be transmitted via different protocols. In other embodiments, the same type of data may be transmitted via different protocols.

[0039] The communication device 102 and the access point or network device 106 may be deployed as and / or executed on any type and form of computing device, such as a computer, network device, or appliance capable of communicating over any type and form of network and performing the operations described herein. Figure 1B and 1C A block diagram of a computing device 100 suitable for practicing embodiments of a wireless communication device 102 or a network device 106 is depicted. Figure 1B and 1C As shown in FIG. 1 , each computing device 100 includes a processor 121 (eg, a central processing unit) and a main memory unit 122. Figure 1B As shown in FIG. 1 , computing device 100 may include storage device 128, installation device 116, network interface 118, I / O controller 123, display devices 124a to 124n, keyboard 126, and pointer device 127 (e.g., mouse). Storage device 128 may include an operating system and / or software. Figure 1C As shown in , each computing device 100 may also include additional optional elements that communicate with the central processing unit or processor 121, such as a memory port 103, a bridge 170, one or more input / output devices 130a to 130n, and a cache memory 140.

[0040] The central processing unit or processor 121 is any logic circuitry that responds to and processes instructions fetched from the main memory unit 122. In many embodiments, the central processing unit or processor 121 is provided by a microprocessor unit, such as those manufactured by Intel Corporation of Santa Clara, California; by International Business Machines of White Plains, New York; or by Advanced Micro Devices of Sunnyvale, California. The computing device 100 may be based on any of these processors or any other processor capable of operating as described herein.

[0041] The main memory unit 122 may be one or more memory chips capable of storing data and allowing the microprocessor or processor 121 to directly access any storage location, such as any type or variant of static random access memory (SRAM), dynamic random access memory (DRAM), ferroelectric RAM (FRAM), NAND flash memory, NOR flash memory, and solid-state drive (SSD). The main memory unit 122 may be based on any of the memory chips described above or any other available memory chip capable of operating as described herein. Figure 1B In the embodiment shown in , processor 121 communicates with main memory unit 122 via system bus 150 (described in more detail below). Figure 1C An embodiment of the computing device 100 is depicted in which the processor communicates directly with the main memory unit 122 via the memory port 103. For example, in Figure 1C In the embodiment, the main memory unit 122 may be a DRDRAM.

[0042] Figure 1C An embodiment is depicted in which the main processor 121 communicates directly with the cache memory 140 via an auxiliary bus (sometimes referred to as a backside bus). In other embodiments, the main processor 121 communicates with the cache memory 140 using the system bus 150. The cache memory 140 typically has a faster response time than the main memory unit 122 and is provided by, for example, SRAM, BSRAM, or EDRAM. Figure 1C, the processor 121 communicates with various I / O devices 130 via a local system bus (e.g., system bus 150). Various buses may be used to connect the central processing unit or processor 121 to any of the I / O devices 130, such as a VESA VL bus, an ISA bus, an EISA bus, a Micro Channel Architecture (MCA) bus, a PCI bus, a PCI-X bus, a PCI Express bus, or a NuBus. For embodiments in which the I / O device is a video display 124, the processor 121 may communicate with the display 124 using an Advanced Graphics Port (AGP). Figure 1C An embodiment of a computer or computer system 100 is depicted in which the main processor 121 can communicate directly with the I / O device 130b, such as via HYPERTRANSPORT, RAPIDIO, or INFINIBAND communication techniques. Figure 1C Also depicted is an embodiment in which local buses are mixed with direct communications: processor 121 communicates with I / O device 130a using a local interconnect bus while communicating directly with I / O device 130b.

[0043] A variety of I / O devices 130a to 130n may be present in the computing device 100. Input devices include keyboards, mice, track pads, track balls, microphones, dials, touch pads, touch screens, and drawing tablets. Output devices include video displays, speakers, inkjet printers, laser printers, projectors, and dye sublimation printers. Figure 1B , the I / O devices may be controlled by an I / O controller 123. The I / O controller may control one or more I / O devices, such as a keyboard 126 and a pointer device 127, such as a mouse or light pen. In addition, the I / O devices may also provide storage and / or installation media for the computing device 100. In yet other embodiments, the computing device 100 may provide a USB connection (not shown) to receive a handheld USB storage device, such as the USB flash drive series of devices manufactured by Twintech Industry, Inc. of Los Alamitos, California.

[0044] Reference again Figure 1B, the computing device 100 may support any suitable installation device 116, such as a disk drive, a CD-ROM drive, a CD-R / RW drive, a DVD-ROM drive, a flash memory drive, a tape drive in various formats, a USB device, a hard drive, a network interface, or any other device suitable for installing software and programs. The computing device 100 may further include a storage device, such as one or more hard drives or a redundant array of independent disks, for storing an operating system and other related software, and for storing application software programs (such as any program or software 120 used to implement (e.g., configured and / or designed for) the systems and methods described herein). Optionally, any of the installation devices 116 may also be used as a storage device. In addition, the operating system and software may be run from a bootable media.

[0045] In addition, the computing device 100 may include a network interface 118 that interfaces to a network through various connections, including but not limited to a standard telephone line, a LAN or WAN link (e.g., 802.11, T1, T3, 56kb, X.25, SNA, DECNET), a broadband connection (e.g., ISDN, Frame Relay, ATM, Gigabit Ethernet, Ethernet over SONET, a wireless connection, or some combination of any or all of the above. Various communication protocols may be used (e.g., TCP / IP, IPX, SPX, NetBIOS, Ethernet, ARCNET, SONET, SDH, Fiber Distributed Data Interface (FDDI), RS232, IEEE 802.11, IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, IEEE 802.11ac, IEEE The computing device 100 may establish a connection via any type and / or form of gateway or tunneling protocol, such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS). The network interface 118 may include a built-in network adapter, a network interface card, a PCMCIA network card, a card bus network adapter, a wireless network adapter, a USB network adapter, a modem, or any other device suitable for interfacing the computing device 100 to any type of network capable of communicating and performing the operations described herein.

[0046] In some embodiments, the computing device 100 may include or be connected to one or more display devices 124a to 124n. Thus, any one of the I / O devices 130a to 130n and / or the I / O controller 123 may include any type and / or form of suitable hardware, software, or a combination of hardware and software to support, enable, or provide the computing device 100 with connection and use of the display devices 124a to 124n. For example, the computing device 100 may include any type and / or form of video adapters, video cards, drivers, and / or libraries for interfacing, communicating, connecting, or otherwise using the display devices 124a to 124n. In one embodiment, the video adapter may include multiple connectors for interfacing to the display devices 124a to 124n. In other embodiments, the computing device 100 may include multiple video adapters, each of which is connected to the display devices 124a to 124n. In some embodiments, any part of the operating system of the computing device 100 may be configured to use multiple display devices 124a to 24n. In other embodiments, the I / O device 130 may be a bridge between the system bus 150 and an external communication bus, such as a USB bus, an Apple desktop bus, an RS-232 serial connection, a SCSI bus, a FireWire bus, a FireWire 800 bus, an Ethernet bus, an AppleTalk bus, a Gigabit Ethernet bus, an asynchronous transfer mode bus, a Fibre Channel bus, a fiber optic bus, a serial attached small computer system interface bus, a USB connection, or an HDMI bus.

[0047] Figure 1B and 1CA computing device 100 of the type depicted in the drawings may operate under the control of an operating system that controls the scheduling of tasks and access to system resources. The computing device 100 may run any operating system, such as any of the following: versions of the MICROSOFT WINDOWS operating system, different versions of the Unix and Linux operating systems, any version of the MAC OS for Macintosh computers, any embedded operating system, any real-time operating system, any open source operating system, any proprietary operating system, any operating system for mobile computing devices, or any other operating system capable of running on a computing device and performing the operations described herein. Typical operating systems include, but are not limited to, Android produced by Google Inc., WINDOWS 7, 8 and 10 produced by Microsoft Corporation of Redmond, Washington, MAC OS produced by Apple Computer, Inc. of Cupertino, California, WebOS produced by Research In Motion (RIM), OS / 2 produced by International Business Machines Corporation of Armonk, New York, and the freely available Linux operating system released by Caldera Corp. of Salt Lake City, Utah, or any type and / or form of Unix operating system, as well as other operating systems.

[0048] The computer system or computing device 100 may be any workstation, phone, desktop computer, laptop or notebook computer, server, handheld computer, mobile phone or other portable telecommunication device, media playback device, gaming system, mobile computing device, or any other type and / or form of computing device, telecommunication device, or media device capable of communication. In some embodiments, the computing device 100 may have a different processor, operating system, and input device consistent with the device. For example, in one embodiment, the computing device 100 is a smart phone, mobile device, tablet computer, or personal digital assistant. In addition, the computing device 100 may be any workstation, desktop computer, laptop or notebook computer, server, handheld computer, mobile phone, any other computer or other form of computing device or telecommunication device capable of communication and having sufficient processor power and memory capacity to perform the operations described herein.

[0049] Aspects of the operating environment and components described above will be apparent in the context of the systems and methods disclosed herein.

[0050] B. Protocol for reassociation operation and method and apparatus using such protocol

[0051] Disclosed herein are systems and methods that can be used in any communication system including but not limited to Wi-Fi and LTE networks. The systems and methods can be used with an AP or a STA in, for example, a reference Figure 1A Although embodiments of reassociation request and / or reassociation response operations for communicating in accordance with the IEEE 802.11 standard are described herein, the systems and methods may be used with other networks, such as cellular networks and satellite networks, and in point-to-point communications.

[0052] refer to Figure 2A , the wireless communication network or system 200 includes client devices or STAs 204, 206, 208, and 224 and APs 212, 214, 216, and 222. The STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222 may be referred to in the accompanying drawings. Figure 1A C. Any number of STAs 204, 206, 208, and 224 and APs 212, 214, 216, and 222 may be used in the network or system 200. In some embodiments, a STA or client device may refer to any device for communicating in a communication system and includes, but is not limited to, a fixed, portable, or mobile laptop computer, a desktop personal computer, a personal digital assistant, a workstation, a wearable device, a smart phone, or a Wi-Fi phone. In some embodiments, an access point or AP may refer to a device for communicatively coupling one or more non-AP devices (e.g., client devices or STAs) to a network. In some embodiments, an AP may enable non-AP devices to connect and communicate with a network. In some embodiments, an AP is a wireless access point (WAP) configured to enable wireless communication between non-AP devices. APs include, but are not limited to, mobile, portable, or fixed hotspots, routers, bridges, gNB nodes, eNodeBs, evolved NodeBs, or other communication devices. An AP may provide services for a STA, for example, acting as a connection point to another network.

[0053] STA 204, 206, 208 and 224 and AP 212, 214, 216 and 222 may each include a wireless transceiver and various modules for communicating via a connection. The modules may be software (e.g., firmware), hardware components, and combinations thereof. In some embodiments, each of STA 204, 206, 208 and 224 and AP 212, 214, 216 and 222 includes IEEE 802.11 consistent media access control (MAC) layer circuits and physical (PHY) layer interfaces to the wireless medium and may be part of a larger device or system. In some embodiments, each of STA 204, 206, 208 and 224 and AP 212, 214, 216 and 222 operates according to other standards in addition to the IEEE 802.11 standard.

[0054] After the authentication and association operations, a connection for wireless communication may be established between at least one of the STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222. For example, the STA 208 connects 218 with the AP 212. The STAs 204, 206, 208, and 224 each include circuitry (e.g., a processor or processing circuit 221), and the APs 212, 214, 216, and 222 each include circuitry (e.g., processing circuit 233) for establishing and canceling the connection 218 and for transferring data across the connection. In another example, the STA 204 connects 228 with the AP 212, and the STA 206 connects 229 with the AP 222. STAs 204, 206, 208, and 224 each include circuitry (e.g., processor or processing circuitry 221), and APs 212, 214, 216, and 222 each include circuitry (e.g., processing circuitry 233) for operating in accordance with data request and response operations, as described below. In some embodiments, connections 218, 228, 229, and 226 are wireless connections that are formed using association and / or authorization operations and canceled using disassociation and / or deauthentication operations. In some embodiments, connections 218, 228, 229, and 226 may be single-link, multi-link, or dual-link connections associated with APs 212 and 222 and may be secure connections (e.g., using encryption). In some embodiments, connections 218, 228, 229, and 226 provide data communications and control and management communications in 5G, 6G, 60G, or 2G bands on one or more channels.

[0055] In some embodiments, the STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222 are configured to use a reassociation request / response protocol to facilitate communications between the STAs 204, 206, 208, and 224 and the APs 212, 214, 216, and 222. In some embodiments, the reassociation request / response protocol may be used to facilitate protected reassociation with reduced introduction time.

[0056] refer to Figure 2B According to some embodiments, the device 220 is the AP 212 or the STA 208 ( Figure 2A ) and is configured for a security probe / response protocol. In some embodiments, the device 220 includes a processing circuit 233 and a reassociation module 238 (e.g., a reassociation request / response module). In some embodiments, the reassociation request / response module may refer to a module that processes or provides a reassociation request message, a reassociation response message in response to a reassociation request message, or a reassociation request message and a response message. In some embodiments, the processing circuit 233 is any circuit system or component that can perform logic and communication processing operations and may include a processor 234 and a memory 236.

[0057] In some embodiments, the processing circuit 230 is implemented as a field programmable gate array, an application specific integrated circuit, hardware, software executing a processor, or a state machine. In some embodiments, the processing circuit 230 is part of a layer (e.g., MAC layer, network layer, PHY layer) of an IEEE 802.11 standard device. In some embodiments, the processing circuit 230 may be configured to perform communication operations, frame construction and processing, probe request and response operations, discovery operations, association operations, authorization operations, connection setup, disassociation operations, handover operations, reassociation operations, and deauthentication operations. In some embodiments, the instructions of the processing circuit 230 are stored in a non-transitory medium such as a memory 236. In some embodiments, the processing circuit 221 of the STA 208 and the processing circuit 233 of the AP 212 are similar to the processing circuit 230.

[0058] The memory 236 may be one or more devices (e.g., RAM, ROM, flash memory, hard disk storage) for storing data and / or computer code used to complete and / or facilitate the various process steps described herein. The memory 236 may be or include non-transitory volatile memory, non-volatile memory, and non-temporary computer storage media. The memory 236 may include database components, object code components, script components, or any other type of information structure used to support various activities and the information structures described in the present invention. The memory 236 may be communicatively coupled to the processor 234 and include computer code or instructions for executing one or more process steps described herein. The processor 234 may be implemented as one or more application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), a group of processing components, software that executes the processor, a state machine, or other suitable electronic processing components. In this way, the AP, STA, or network device 106 ( Figure 1A ) is configured to execute various modules and / or programs and store associated data in a database of the memory 236. The modules (e.g., module 238) may be implemented in AP software (e.g., MAC layer or PHY layer software) or STA software (e.g., MAC layer or PHY layer software). In some embodiments, the AP 212 or the STA 208 ( Figure 2A ) is structured and used to establish connections and transfer access rights to other computing systems and devices (e.g., wireless communication device 102, network hardware 192, other access points or network devices 106) via a network (e.g., WAN connection, LAN connection, WLAN connection, etc.). Figure 1A to C)).

[0059] In some embodiments, the reassociation module 238 is configured to provide a reassociation request message. For example, the reassociation module 238 is configured to cause the device 220 to provide a reassociation response message and / or a reassociation request message for a secure reassociation operation. In some embodiments, the reassociation module 238 is configured to cause the device 220 to provide a reassociation response message and / or a reassociation request message for a secure reassociation operation. Figure 2A ) are securely exchanged between the reassociation module 238 and the reassociation module 238. In some embodiments, the reassociation module 238 is configured to implement a secure reassociation request / exchange (SPX) using an existing key for a connection (eg, a previous connection).

[0060] The reassociation module 238 of the SRX device uses a PMF method (e.g., in accordance with 802.11) to protect the corresponding association / reassociation request and association / reassociation response frames as long as both parties have valid keys. When the AP 212 has a valid key and is able to successfully retrieve a secure or protected reassociation request frame from the STA 208, the AP 212 can respond with a secure or protected reassociation response frame using its existing key. In some embodiments, the reassociation operation is not necessarily considered a new connection request, but can be considered a modification request to an existing connection (e.g., the connection 212 for the AP 212 and the STA 208). In some embodiments, the subsequent introduction process steps of communicating and initiating a four-way handshake for the association operation can be avoided. In some embodiments, during the reassociation operation, the AP 212 can advantageously process the reassociation request frame from the STA 208 and adopt those parameters by fulfilling the updated client capabilities or parameters.

[0061] In some embodiments, if the AP 212 has removed the STA 208 from its association list due to long periods of inactivity or due to security reasons, the reassociation module 238 may not respond to the SRX request message of the STA 208. In this case, the STA 208 falls back to the old connection process (e.g., discovery, association, authentication, and four-way handshake operations).

[0062] In some embodiments, when the STA 208 sends a secure reassociation request message and the AP responds with an unsecure reassociation response, the reassociation module 238 of the STA 208 rejects the unsecure reassociation response and follows the legacy connection procedure. If the STA 208 sends an unsecure reassociation request message (e.g., as part of a new roaming attempt to a target AP) and the AP does not have the STA 208 in its association list, the target AP will follow the legacy operation of sending an unsecure reassociation response followed by initiating a four-way handshake using an authentication operation. When the STA 208 sends an unsecure reassociation request message (when the STA 208 clears the earlier connection details with the AP including the key) and the AP has the STA 208 on its association list, the AP may follow the SA query procedure recommended by the existing 802.11w specification for reassociation.

[0063] In some embodiments, as an additional security measure, the reassociation module 238 of the SRX-aware AP 212 may schedule a unicast key rotation or refresh after the introduction of a STA. In certain scenarios, when a device 220 (e.g., STA 208) roams from a connected AP (e.g., AP 212), the device 220 does not communicate any messages with the existing AP and looks for a new target AP. The device 220 attempts to connect to the new target AP by assuming that the device 220 can obtain better performance by moving to the new target AP (e.g., because the device 220 has moved closer to the new target AP). However, this assumption may not be correct, the device 220 may temporarily move out of the range of the connected AP and return, or the roaming attempt with the connected AP may have failed (e.g., during a four-way handshake) and the device may not have any choice other than returning to the existing AP. During such a scenario, if the device 220 makes an unsecure reassociation request, the existing AP may treat the device 220 as an intruder and initiate the SA query process. After the SA query times out, the AP terminates the existing connection at 220 and starts introducing this client as a new connection, followed by a four-way handshake.

[0064] In some embodiments, the device 220 operates according to the SRX protocol in the above scenario and the device 220 retains the key and provides a secure reassociation request message. If the AP also has the device in its association list, the AP sends a secure reassociation response and the device 220 is connected in the same network, thereby making roaming much faster.

[0065] In some embodiments, the reassociation module 238 of the SRX-aware STA 208 that intends to change its association time configuration parameters for various reasons of its own (such as upgrading / downgrading the transmit (Tx) / receive (Rx) chains for power saving purposes or concurrency purposes, etc.) or temporarily changing the supported rates for power saving purposes can dynamically configure all such parameters (e.g., the number of supported Tx chains and Rx chains, upgrade / downgrade and supported rates - EHT, VHT, HE, etc.). In some embodiments, the reassociation module 238 can dynamically configure all non-security related change parameters. In some embodiments, the device 220 operates according to the SRX protocol to update the number of operating links for multi-link (ML) operation with the AP. Any unprotected (re)association frame will generally result in an SA query operation. However, the device 220 can use the SRX protocol (e.g., utilizing the 802.11be multi-link operation mode) according to the following scenarios:

[0066] 1) AP 212 adds a new link and STA 208 wants to use the newly added link for its ML operation (MLO).

[0067] 2) STA 208 initially associates on only a subset of the AP's supported links and wants to increase the number of operating links (eg, from a 2-link MLO association to a 3-link MLO association).

[0068] 3) STA 208 is initially associated with all or a subset of the supported links of AP 212 and wants to reduce the number of currently operating links (eg, from a 3-link MLO association to a 2-link MLO association).

[0069] 4) Traffic Identifier to Link (TID2LINK) mapping can be changed by STA 208 according to its needs.

[0070] The protected reassociation request may be used to communicate new communication parameters and reassociate device 220 with the AP.

[0071] refer to Figure 3 , reassociation module 238 ( Figure 2B ) handles the reassociation operation between AP 212 and STA 208. In some embodiments, STA 208 and AP 212 support beacon protection. STA 208 and AP 212 perform process 300 to handle broadcast probe request frames using a secure probe request / response protocol. When an active scan is issued at operation 302, STA 208 provides a broadcast probe request frame. AP 212 with beacon protection enabled responds to the broadcast probe request frame by providing an unprotected (without management frame protection (MFP)) unicast probe response frame in operation 304. In some embodiments, an unprotected probe response frame for a broadcast probe request frame is sent regardless of whether STA 208 is associated with or not associated with AP 212. At operation 306, the association is completed. At operation 307, AP 212 provides a beacon frame in operation 307. The beacon frame includes an information element (IE) or a management MIC element (MME) for a management message integrity code (MIC). The four-way handshake is completed at operation 308 and the connection between STA 208 and AP 212 is completed. In operations 310a-n, a beacon frame may be provided using the MME after the connection is established.

[0072] An event occurs at operation 312. In some embodiments, the event may be a failed roaming attempt (e.g., returning to a previously connected AP), a capability / parameter reconfiguration (e.g., a STA configuration change), or a multi-link configuration change. In some embodiments, the AP 212 still retains information with the old key value of the STA 208. In some embodiments, operation 312 may also be a failed roaming attempt, a capability / parameter reconfiguration, or a multi-link configuration change.

[0073] After operation 312, a protected reassociation request message (e.g., frame 313) is directed from STA 208 specifically to reassociate to the previously associated AP (e.g., AP 212). In some embodiments, in operation 314, a protected reassociation request message (e.g., frame 313) is provided from STA 208 to AP 212. AP 212 verifies the secure reassociation request message and in operation 315 provides an optional protected reassociation response message or frame 316 in response to the protected reassociation request frame 313 sent in operation 314. Frames 313 and 316 in operations 314 and 315 may include information for completing the reassociation. In operation 322, the reassociation is complete.

[0074] Using the process 300, AP and STA reassociation occurs more quickly without the need for teardown (e.g., higher layers remain unchanged) and a new four-way handshake. In some embodiments, in operation 317, an optional refresh unicast key may be sent from the AP 212 to the STA 208. For example, using the process 300, the STA 208 retains the key information and makes a secure reassociation request, and as long as the AP 212 still has the client in its association list. The AP 212 sends a secure reassociation response, and then the STA 208 can operate in the same network, thereby achieving faster roaming.

[0075] refer to Figure 4 , the reassociation request frame 400 may include a MAC header 402 and a frame body 404 and may be configured as a protected frame (e.g., a protected management frame with subtype 2). Frame 400 is sent by a STA (e.g., STA 208). Frame body 404 may include fields for parameters such as capabilities or configured parameters that may be changed during reassociation. For example, frame body 404 may include information elements in fields for device capabilities (e.g., supported rates, number of supported Rx and TX chains, and multilink parameters). A reassociation response frame may be similar to frame 400 and is sent by an AP (AP 212). In some embodiments, the reassociation response frame may be an acknowledgment of the reassociation request frame and be configured as a secure frame. In some embodiments, the reassociation response frame may be configured as a protected frame (e.g., a protected management frame with subtype 3) and may indicate whether the STA is allowed to rejoin. In some embodiments, the STA may send an acknowledgment of the reassociation response frame to the AP.

[0076] It should be noted that certain paragraphs of the present disclosure may refer to terms such as "first" and "second" in conjunction with subgroups of frames, responses, and devices for the purpose of identifying or distinguishing one from another or others. These terms are not intended to relate entities (e.g., first and second devices) only in time or according to a sequence, although in some cases, these entities may include such a relationship. These terms also do not limit the number of possible entities (e.g., STAs, APs, beam formers, and / or beamformees) that can operate within a system or environment. It should be understood that the system described above may provide multiple of any one or each of those components, and these components may be provided on a stand-alone machine or (in some embodiments) on multiple machines in a distributed system. Further, bit field positions may be changed and multi-bit words may be used. In addition, the systems and methods described above may be provided as one or more computer-readable programs or executable instructions embodied on or in one or more articles of manufacture (e.g., floppy disks, hard disks, CD-ROMs, flash memory cards, PROMs, RAMs, ROMs, or tapes). The program may be implemented in any programming language such as LISP, PERL, C, C++, C#, etc. or in any byte code language such as JAVA, etc. The software program or executable instructions may be stored as object code on or in one or more articles of manufacture. A circuit system may refer to any electronic circuit or circuits.

[0077] Circuitry or circuitry may refer to any electronic circuit or combination of circuits. To the extent that a device, circuit, processor, or circuitry is described or recited in a claim as performing one or more operations or functions or being configured to perform one or more operations or functions, the performance of the recited functions or operations may be distributed across two or more devices, circuits, or processors without departing from the scope of the claims unless those functions or operations are expressly recited as being performed on a particular single circuit or group of circuits, processors, or devices (e.g., using the phrases "on a single circuit," "on a group of circuits comprising," or "on a single device").

[0078] Although the foregoing written description of the methods and systems enables one of ordinary skill in the art to make and use embodiments thereof, one of ordinary skill in the art should understand and appreciate variations, combinations, and equivalents of the specific embodiments, methods, and examples presented herein. For example, the specific values ​​of bandwidth, channels, and sub-bands discussed above are exemplary. Therefore, the present methods and systems should not be limited by the embodiments, methods, and examples described above, but rather by all embodiments and methods within the scope and spirit of the present disclosure.

Claims

1. A first device, comprising: Circuitry configured to provide at least one frame to the second device, the frame comprising a protected reassociation request message.

2. The first device of claim 1, wherein the frame is provided according to an 802.11 protocol and a connection is reestablished by using a reassociation operation. The first device according to claim 1 , wherein the first device is a station (STA) that enables beacon protection. 4 . The first device of claim 1 , wherein the circuit is configured to receive a protected reassociation response message from the second device. The first device of claim 1 , wherein the second device is an access point supporting beacon protection. 6 . The first device of claim 1 , wherein the circuit is configured to receive a protected reassociation response message from the second device and to provide a confirmation message in response to the protected reassociation response message. 7 . The first device of claim 6 , wherein the circuit is configured to provide the protected reassociation response message with information of links for multi-link operation. The first device of claim 7 , wherein the information is for a reduced number of the links.

9. The first apparatus of claim 7, wherein the information is related to a service identifier to link mapping.

10. A first device, comprising: Circuitry configured to provide at least one frame to the second device in response to the protected reassociation request message, the frame including a protected reassociation response message.

11. The first device of claim 10, wherein the frame is provided according to an 802.11 protocol and a connection is established using an association or authentication operation, and wherein the first device is a beacon protection enabled access point. 12 . The first device of claim 10 , wherein the frame includes information indicating confirmation of re-association of a connection between the first device and the second device.

13. The first device of claim 10, wherein the circuit is configured to provide the frame if the second device is on an associated device list stored on the first device.

14. The first device of claim 10, wherein the circuit is configured to not provide the frame if the second device is not on an associated device list stored on the first device.

15. A method of operating a first device, the first device being connected to a second device, the connection having associated key information, the method comprising: providing a protected reassociation request message from the first device to the second device across the connection using the key information following an event affecting the connection; and A protected reassociation response message is received at the first device from the second device using the key information.

16. The method of claim 15, wherein the protected reassociation request message is a protected management frame.

17. The method of claim 15, wherein the event comprises a failed roaming attempt, a capability / parameter reconfiguration, or a multi-link configuration change.

18. The method of claim 15, wherein the protected reassociation response message from the second device is provided if the first device is on a list of associated devices stored on the second device. The method of claim 15 , wherein the event is a change in a multi-link configuration.

20. The method of claim 15, wherein the event comprises roaming occurring from the second device.

Images