Information frame transmission method, network equipment and storage medium

Abstract

The invention provides an information frame transmission method, network equipment and a storage medium. The method comprises the following steps: sending a first information frame to a second network device, wherein the first information frame comprises first frame number information and first secret key generation information of a first network device; receiving a second information frame of the second network equipment, wherein the second information frame comprises second frame number information, second secret key generation information of the second network equipment and the first MIC; generating a first PTK, wherein the first PTK is used for encrypting or decrypting a unicast message between the first network device and the second network device; verifying the first MIC according to the first PTK and generating a second MIC; and sending a third information frame, wherein the third information frame comprises third frame number information and the second MIC.

Description

Technical Field

[0001] The present application relates to the field of wireless communication technology, for example, to an information frame transmission method, a network device and a storage medium. Background Art

[0002] Each network device may support one or more multi-network device collaboration technologies. Network devices need to define certain signals (or unicast frames) to negotiate which specific method to use to complete the collaboration. In the process of network device negotiation, there is a lack of protection measures, and the unicast frame interaction content between network devices will be at risk of being intercepted and maliciously tampered by a third party. In addition, in the network device collaboration process, a network device can send a trigger frame (Trigger frame, TF) to other surrounding network devices. The trigger frame contains sensitive information. The frame is sent in plain text in the form of broadcast, which is at risk of being intercepted and tampered by a third party. The security of transmission between network devices needs to be improved. Summary of the invention

[0003] The present application provides a data frame transmission method, a network device and a storage medium.

[0004] The embodiment of the present application provides an information frame transmission method, which is applied to a first network device, including:

[0005] Sending a first information frame to a second network device, wherein the first information frame includes first frame number information and first key generation information of the first network device;

[0006] receiving a second information frame from the second network device, wherein the second information frame includes second frame number information, second key generation information of the second network device, and a first message integrity check code (MIC);

[0007] Generate a first pairwise transient key (PTK), where the first PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device;

[0008] Verify the first MIC according to the first PTK and generate a second MIC;

[0009] A third information frame is sent, where the third information frame includes third frame number information and the second MIC.

[0010] The embodiment of the present application further provides an information frame transmission method, which is applied to a second network device, including:

[0011] Receiving a first information frame of a first network device, wherein the first information frame includes first frame number information and first key generation information of the first network device;

[0012] generating a second PTK, wherein the second PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device;

[0013] generating a first MIC according to the second PTK;

[0014] Sending a second information frame to the first network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC;

[0015] A third information frame from the first network device is received, where the third information frame includes third frame number information and a second MIC generated by the first network device.

[0016] An embodiment of the present application further provides a network device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned information frame transmission method when executing the program.

[0017] An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned information frame transmission method is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of an information frame transmission method provided by an embodiment;

[0019] Figure 2 A schematic diagram of transmitting an authentication frame between network devices provided by an embodiment;

[0020] Figure 3 A schematic diagram of a format of a first authentication frame provided by an embodiment;

[0021] Figure 4 A schematic diagram of a format of a second authentication frame provided by an embodiment;

[0022] Figure 5 A schematic diagram of a format of a third authentication frame provided by an embodiment;

[0023] Figure 6 A schematic diagram of a PTK format provided by an embodiment;

[0024] Figure 7 A schematic diagram of a format of an RSNE provided by an embodiment;

[0025] Figure 8 A flowchart of an information frame transmission method provided by an embodiment;

[0026] Fig. 9 A schematic diagram of the structure of an information frame transmission device provided by an embodiment;

[0027] Fig.10 A schematic diagram of the structure of an information frame transmission device provided by an embodiment;

[0028] Fig.11 A schematic diagram of the hardware structure of a network device provided in an embodiment. DETAILED DESCRIPTION

[0029] The present application is described below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily. It should also be noted that, for ease of description, only the parts related to the present application rather than all structures are shown in the accompanying drawings.

[0030] Figure 1 The flowchart of a method for transmitting an information frame provided in an embodiment. The method can be applied to a first network device. In the embodiment of the present application, the network device can be a station (Station) or an access point (Access Point, AP), and the first network device and the second network device perform authentication and interaction through three types of information frames, and negotiate and generate a secret key on this basis. Figure 1 As shown, the method provided in this embodiment includes the following steps:

[0031] In step 110, a first information frame is sent to a second network device, wherein the first information frame includes first frame number information and first key generation information of the first network device.

[0032] In step 120, a second information frame of the second network device is received, where the second information frame includes second frame number information, second key generation information of the second network device, and a first MIC.

[0033] In step 130, a first PTK is generated, where the first PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device.

[0034] In step 140, the first MIC is verified according to the first PTK and a second MIC is generated.

[0035] In step 150, a third information frame is sent, where the third information frame includes third frame number information and the second MIC.

[0036] In this embodiment, the first network device (such as AP1) exchanges three types of information frames with the second network device (such as AP2), and the information frames can be authentication frames or Extensible Authentication Protocol over LAN (EAPOL) frames. The first information frame includes frame number information, first key generation information of the first network device (such as public key information, S-Ephemeral Pub), and can also include robust security network elements (Robust Security Network Element, RSNE), extended robust security network elements (RSN extension element, RSNXE), master / slave (Master / Slave) network device indication information, etc.

[0037] After receiving the first information frame, the second network device generates the second key generation information (such as public key information, recorded as A-Ephemeral Pub) locally, and generates PTK (i.e., the second PTK) according to a certain algorithm. In the case where the information frame is an authentication frame, it can also generate a second PTK according to the second PTK.<KEK2,KCK2,TCK2> , where KEK2 (i.e., the second KEK) is used to encrypt and decrypt authentication frames, KCK2 (i.e., the second KCK) is used to calculate the first MIC, and TCK2 (i.e., the second TCK) is used to encrypt and decrypt control frames. The second KEK can also encrypt the frame body (Frame Body), and can also encrypt part of the authentication frame information, such as encrypting and decrypting the multicast key (Group Key, GK) and other information encryption.

[0038] The second network device sends a second information frame to the first network device. The second information frame always includes frame number information, second key generation information of the second network device (such as public key information, A-Ephemeral Pub), and may also include RSNE, RSNXE, GK information, indication information of master and slave network devices, the first MIC, etc.

[0039] After receiving the second authentication frame, the first network device generates a PTK (i.e., the first PTK) locally. In the case where the information frame is an authentication frame, KCK1 (i.e., the first KCK) and KEK1 (i.e., the first KEK) can be further generated according to the first PTK, wherein the first KCK is used to verify the first MIC and generate the second MIC, and the first KEK can be used to decrypt the message and obtain the GK information.

[0040] In addition, the first network device sends a third information frame to the second network device, including frame number information and the second MIC, etc.

[0041] Figure 2 FIG. 1 is a schematic diagram of transmitting an authentication frame between network devices provided by an embodiment. Figure 2 As shown in the figure, in multi-AP mode, APs can generate and transmit protected keys through frame interaction. APs can use three authentication frame interactions to generate unicast keys PTK, and further generate key encryption keys (Key Encryption Key, KEK) for authentication frame encryption and decryption and TCK for control frame encryption and decryption based on PTK; master AP and slave AP can be negotiated in the three-way handshake project; Master AP is responsible for distributing and maintaining GK, which can be transmitted through the second authentication frame or the third authentication frame.

[0042] The method of this embodiment can be applied in the multi-AP (Multi-AP, MAP) collaboration process defined by Wi-Fi 8. AP1 and AP2 use the generated PTK to encrypt and decrypt unicast messages exchanged between APs. In addition, GK can be used to encrypt and decrypt broadcast messages exchanged between APs. It can also be applied in the interoperation process between AP and STA (the corresponding information frame is an EAPOL frame).

[0043] In one embodiment, when the information frame is an authentication frame, the first key generation information includes first public key information (S-Ephemeral Pub), and the second key generation information includes second public key information (A-Ephemeral Pub); when the information frame is an EAPOL frame, the first key generation information includes a first random number; and the second key generation information includes a second random number.

[0044] In one embodiment, the first network device includes a first site or a first access point or a first multi-link access point or a first multi-link site; the second network device includes a second site or a second access point or a second multi-link site or a second multi-link access point. The network device in this embodiment may be a multi-link device (Multi-LinkDevice, MLD), such as a site may be a multi-link site (non-AP MLD), and an access point may be a multi-link access point (APMLD).

[0045] In one embodiment, when the information frame is an authentication frame, the first information frame and the second information frame further include RSNE and RSNXE; when the information frame is an EAPOL frame, the second information frame and the third information frame further include RSNE and RSNXE.

[0046] In one embodiment, the first authentication frame, the second authentication frame and the third authentication frame also include indication information for indicating that the first network device is a master network device or a slave network device, and correspondingly indicating that the second network device is a slave network device or a master network device. In this embodiment, the master / slave AP is indicated in a display manner, that is, the first authentication frame and the second authentication frame contain the master / slave AP indication information. It should be noted that the indication information carried in the two authentication frames cannot indicate master or slave at the same time.

[0047] In one embodiment, the method further includes: determining that the first network device is a master network device or a slave network device according to a predefined field, and correspondingly determining that the second network device is a slave network device or a master network device. In this embodiment, the master / salve AP is indicated in an implicit manner, that is, the authentication frame does not contain the master / salve AP, but through a predefined specific field comparison method, for example, comparing the media access control (MAC) address information of both parties, one party is automatically formed as the master and the other party as the slave. On this basis, the master is the party that transmits the GK, and the slave is the party that receives the GK.

[0048] In one embodiment, the method also includes: when the first network device is a master network device, transmitting GK information to the second network device through a third authentication frame; when the first network device is a slave network device, receiving GK information transmitted by the second network device through a second authentication frame; wherein the GK information is used to encrypt or decrypt broadcast messages between network devices. Figure 2 In the example, when AP2 is the master, the GK is transmitted through the second authentication frame; when AP1 is the master, the GK is transmitted through the third authentication frame.

[0049] In one embodiment, the method further includes: when the first network device is a master network device, transmitting the cooperation group identification information (Group ID) to the second network device through the third authentication frame; when the first network device is a slave network device, receiving the cooperation group identification information transmitted by the second network device through the second authentication frame. In this embodiment, the masterAP can not only transmit the GK, but also generate the Group ID information that uniquely identifies a cooperation group. The Group ID may be sent to the slave AP together with the GK information in the second authentication frame or the third authentication frame.

[0050] Table 1 shows a MAP parameter table for transmitting MAP information. As shown in Table 1, the authentication frame may include indication information of master and slave network devices, cooperation group identification information and / or GK information.

[0051]

[0052] Figure 3 FIG. 1 is a schematic diagram of a format of a first authentication frame provided by an embodiment. Figure 3 As shown, the first authentication frame includes frame number and frame type information (1.PASN), status indication information (Status Code), STA-side RSNE (including STA-selected authentication and key management protocol (Authentication and Key Management Protocol, AKMP information), PASN parameters (PASN parameters, including STA-side public key information S-Ephemeral Pub, wired cyclic group information (Finite Cyclic Group ID, etc.), corresponding to the AKMP in RSNE located in the wrapped data (Wrapped Data) field AKMP data-1 information, STA-side RSNXE and multi-AP collaboration parameters (including master-slave network device indication information).

[0053] Figure 4 FIG. 1 is a schematic diagram of a format of a second authentication frame provided by an embodiment. Figure 4 As shown, the second authentication frame includes frame number and frame type information (2.PASN), status indication information (Status Code), AP-side RSNE (including AKMP information selected by AP), PASN parameter information (PASN parameters, including AP-side public key information A-EphemeralPub), AKMP data-2 information located in the packaging data field corresponding to AKMP in RSNE, AP-side RSNXE, multi-AP collaboration parameters (including indication information of master and slave network devices, collaboration group identification information and GK information) and MIC1.

[0054] Figure 5 FIG. 1 is a schematic diagram of a format of a third authentication frame provided by an embodiment. Figure 5 As shown, the third authentication frame includes frame number and frame type information (3.PASN), status indication information (Status Code), AKMP data-3 information corresponding to AKMP located in the package data field, multi-AP collaboration parameters (including indication information of master and slave network devices, collaboration group identification information and GK information) and MIC2.

[0055] In one embodiment, the method further includes: determining a first key confirmation key (KCK) and a first key encryption key KEK based on the first PTK, the first KCK is used to verify the first MIC and generate the second MIC, and the first KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

[0056] In one embodiment, the second authentication frame or the third authentication frame also includes GK information; the GK information includes at least one of the following: a group temporary key (Group Temporal Key, GTK) used to encrypt or decrypt multicast data frames transmitted between the first network device and the second network device, an integrity group temporary key (Integrity Group Temporal Key, IGTK) used to encrypt or decrypt multicast management frames transmitted between the first network device and the second network device, and an Integrity Control Temporal Key, ICTK) used to encrypt or decrypt multicast control frames transmitted between the first network device and the second network device.

[0057] In one embodiment, one GK may be used to encrypt and decrypt all frame types transmitted between APs.

[0058] In one embodiment, generating a second MIC includes: based on MAC address information of the first network device, MAC address information of the second network device, a hash value of a first Preassociation Security Negotiation (PASN) frame body, remaining information of a third authentication frame excluding a frame header and the second MIC, a first KCK, and a hash algorithm.

[0059] In this embodiment, MIC2 is generated according to the following information: MAC address information of two APs, F1 Auth, FrameData, the first KCK and the hash algorithm (HMAC-HASH). For example, the generation algorithm of MIC2 is expressed as follows:

[0060] HMAC-HASH(KCK1, AP1 MAC address information||AP2 MAC address information||F1 Auth||Frame Data)

[0061] Among them, HMAC-HASH: a HASH algorithm;

[0062] KCK1: key confirmation key, generated from the first PTK;

[0063] AP1 MAC address information: Basic Service Set Identifier (BSSID) information of AP1, or its corresponding AP Multi-Link Device (MLD) address information, or Transmitter Address (TA) information;

[0064] AP2 MAC address information: BSSID information of AP2, or its corresponding AP MLD address information, or receiver address (RA) information;

[0065] F1 Auth: Hash value of the first PASN frame body;

[0066] Frame Data: The remaining information in the third authentication frame except the frame header and MIC.

[0067] In one embodiment, generating a first PTK includes: generating the first PTK according to the MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the pairwise master key (PMK), and a hash function. In this embodiment, the first PTK is generated by the parameters of the AP1 MAC address information, the AP2 MAC address information, the shared key (Diffie-Hellman Shared Secret, DHss) generated by the Diffie-Huffman protocol and the PMK, and the key generation hash function. The AP1 / AP2 MAC address information may be the BSSID information of AP1 / AP2, or may be the MAC address information of the AP MLD corresponding to AP1 / AP2.

[0068] For example, a PTK generation formula is expressed as:

[0069] PTK = KDF-HASH-NNN (PMK, "PTK Derivation", AP1 MAC information || AP2 MAC information || DHss)

[0070] Among them, PMK is the pairwise master key information;

[0071] DHss is a shared key generated by the Diffie-Huffman protocol based on the public key;

[0072] AP1 MAC is the MAC address information of AP1;

[0073] AP2 MAC is the MAC address information of AP2;

[0074] “PASN PTK Derivation” is the label;

[0075] KDF-HASH-NNN: Generates hash algorithm information based on the key determined by the interactive Authentication and Keymanagement Protocol (AKMP) parameters.

[0076] In one embodiment, the information frame may be an EAPOL frame or an authentication frame, and the method further includes:

[0077] Determine at least one of the following based on the first PTK: a first temporary key (Temporal Key, TK) for encryption or decryption of unicast data and management frames;

[0078] A first key generation key (Key Derivation key, KDK) for generating key information;

[0079] A first temporary control key (TCK) for encryption or decryption of unicast control frames;

[0080] A first KEK for encrypting or decrypting the authentication frame;

[0081] The first KCK used to verify the MIC.

[0082] Figure 6 FIG. 1 is a schematic diagram of a PTK format provided by an embodiment. Figure 6 As shown, in addition to the traditional 256-bit KCK, 128 or 256-bit TK, and 256-bit KDK, the extension includes a 128 or 256-bit TCK for control frame encryption and decryption, and a 128 or 256-bit KEK for authentication frame encryption and decryption. The format of the PTK is applicable to the first PTK and the second PTK.

[0083] In one embodiment, the first TCK and the first KEK are generated according to the KDK. In this embodiment, the TCK for unicast control frame encryption and decryption, and the KEK for second and third authentication frame encryption and decryption are generated by the KDK according to a certain algorithm. For example, the TCK is generated by a key generation function and input parameters KDK and seed KDK_seed, and the function expression is: TCK = KDF-Hash-Length (KDK, "TCK generation", KDK_seed)

[0084] KEK is generated by a key generation function KDF-Hash-Length and input parameters KEK and seed KEK_seed. The function expression is: KEK=KDF-Hash-Length(KDK, “KEK generation”, KEK_seed).

[0085] In one embodiment, it also includes: indicating at least one of the following to the target network device through RSNE information: unicast key suite information, authentication frame key suite information, multicast management frame key suite information, unicast control frame key suite information, and multicast control frame key suite information. In this embodiment, the RSNE information exchanged between AP1 and AP2 includes at least one of the following information: unicast key suite information (Pairwise Cipher Suite), authentication frame key suite information (AKM Suite), multicast management frame key suite information (Group Management Cipher Suite), unicast control frame key suite information (Pairwise Cipher Suite for Control), and multicast control frame key suite information (Group Control Cipher Suite).

[0086] In one embodiment, the method further includes: indicating the key suite of the unicast control frame and the key suite for indicating the multicast control frame to the target network device through RSNE information.

[0087] Figure 7 FIG. 1 is a schematic diagram of a format of a RSNE provided by an embodiment. Figure 7 As shown, RSNE contains unicast control frame key suite information and multicast control frame key suite information for control with a length of 0 or 4 bytes, which are used to indicate the key suite of the unicast control frame and the key suite of the multicast control frame respectively. In addition, Table 2 shows the description of other fields in RSNE.

[0088] Table 2 Description of some fields in RSNE

[0089]

[0090]

[0091] The method of this embodiment can use the PASN extended protocol to generate PTK and transfer GK between network devices. In the PASN process, the unicast control key TCK and the authentication frame encryption key KEK are generated; in the PASN process, the master / slave network device is negotiated and indicated; the unicast and multicast control frame key suite is indicated in RSNE; in the PASN process, MIC information is generated. In addition, in addition to the PASN process, the unicast and multicast control frame key suite is indicated in RSNE in other processes; in addition to the PASN process, the PTK is used to generate TCK and KEK in other processes. On this basis, the security and reliability of transmission between network devices are improved.

[0092] Figure 8 A flowchart of an information frame transmission method provided by an embodiment, such as Figure 8 As shown, the method provided in this embodiment includes the following steps:

[0093] In step 210, a first information frame of a first network device is received, wherein the first information frame includes first frame number information and first key generation information of the first network device.

[0094] In step 220, a second PTK is generated, where the second PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device.

[0095] In step 230, a first MIC is generated according to the second PTK.

[0096] In step 240, a second information frame is sent to the first network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC.

[0097] In step 250, a third information frame of the first network device is received, where the third information frame includes third frame number information and a second MIC generated by the first network device.

[0098] In this embodiment, the first network device and the second network device perform authentication and interaction through three types of information frames, and on this basis, generate a secret key through negotiation, thereby improving the reliability and security of information frame transmission.

[0099] In one embodiment, the first information frame includes a first authentication frame; the second information frame includes a second authentication frame; the third information frame includes a third authentication frame; or, the first information frame includes a first extended authentication protocol frame; the second information frame includes a second extended authentication protocol frame; and the third information frame includes a third extended authentication protocol frame.

[0100] In one embodiment, the first authentication frame, the second authentication frame and the third authentication frame also include indication information, and the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicate that the second network device is a slave network device or a master network device.

[0101] In one embodiment, the method further includes: determining, according to a predefined field, whether the first network device is a master network device or a slave network device, and correspondingly determining whether the second network device is a slave network device or a master network device.

[0102] In one embodiment, the method also includes: when the second network device is a master network device, transmitting multicast key GK information to the first network device through the second authentication frame; when the second network device is a slave network device, receiving the GK information transmitted by the first network device through the third authentication frame; wherein the GK information is used to encrypt or decrypt broadcast messages between network devices.

[0103] In one embodiment, the method also includes: when the second network device is a master network device, transmitting collaboration group identification information to the first network device through the second authentication frame; when the second network device is a slave network device, receiving the collaboration group identification information transmitted by the first network device through the third authentication frame.

[0104] In one embodiment, the method further includes: generating a second KCK and a second KEK according to the second PTK, the second KCK is used to calculate the first MIC, and the second KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

[0105] In one embodiment, generating a first MIC based on the second PTK includes: based on the MAC address information of the first network device, the MAC address information of the second network device, the RSNE of the second network device, the RSNXE information of the second network device, the remaining information of the second authentication frame excluding the frame header and the first MIC, a second KCK and a hash algorithm.

[0106] In this embodiment, MIC1 is generated based on the following contents: MAC address information of two APs, RSNE and RSNXE information of AP2 beacon, Frame Data, KCK and algorithm HMAC-HASH. RSNE and RSNXE information of AP1 Beacon may also be included.

[0107] For example, the generation of MIC1 is shown as follows:

[0108] MIC1=HMAC-HASH(KCK,AP2 MAC address information||AP1 MAC address information||AP2 Beacon RSNE||AP2 Beacon RSNXE||AP1 Beacon RSNE||AP1 Beacon RSNXE||Frame Data)

[0109] Among them, HMAC-HASH: a HASH algorithm;

[0110] KCK: used for key confirmation key (KCK), generated from PTK;

[0111] AP2 MAC address information: BSSID information of AP2, or its corresponding AP MLD address information, or transmitter address (TA) address information;

[0112] AP1 MAC address information: BSSID information of AP1, or its corresponding AP MLD address information, or receiver address (RA) address information;

[0113] AP2 Beacon RSNE: RSNE element information carried in the beacon frame sent by AP2;

[0114] AP2 Beacon RSNXE: RSNXE element information carried in the beacon frame sent by AP2;

[0115] AP1 Beacon RSNE: RSNE element information carried in the beacon frame sent by AP1;

[0116] AP1 Beacon RSNXE: RSNXE element information carried in the beacon frame sent by AP1;

[0117] Frame Data: the remaining information in the second authentication frame except the frame header and MIC;

[0118] ||: Connection symbol.

[0119] In one embodiment, generating the second PTK includes: generating the second PTK according to the MAC address information of the first network device, the MAC address information of the second network device, a shared key generated by the Diffie-Huffman protocol, a PMK, and a hash function.

[0120] In one embodiment, the method also includes: determining at least one of the following based on the second PTK: a second TK for encryption or decryption of unicast data and management frames; a second KDK for generating key information; a second temporary control key TCK for encryption or decryption of unicast control frames; a second KEK for encryption or decryption of authentication frames; and a second KCK for verifying MIC.

[0121] The embodiment of the present application also provides an information frame transmission device. Fig. 9 FIG. 1 is a schematic diagram of a structure of an information frame transmission device provided by an embodiment. Fig. 9 As shown, the information frame transmission device includes:

[0122] A first information frame sending module 310 is configured to send a first information frame to a second network device, wherein the first information frame includes first frame number information and first key generation information of the first network device;

[0123] A second information frame receiving module 320, configured to receive a second information frame of the second network device, wherein the second information frame includes second frame number information, second key generation information of the second network device, and a first MIC;

[0124] A first generating module 330, configured to generate a first PTK, wherein the first PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device;

[0125] A first verification module 340, configured to verify the first MIC according to the first PTK and generate a second MIC;

[0126] The third information frame sending module 350 is configured to send a third information frame, where the third information frame includes third frame number information and the second MIC.

[0127] The information frame transmission device of this embodiment uses the PASN extended protocol to generate PTK and transfer GK. In the PASN process, the unicast control key TCK and the authentication frame encryption key KEK are generated; in the PASN process, the master / slave network device is negotiated and indicated; the unicast and multicast control frame key suite is indicated in RSNE; in the PASN process, MIC information is generated. In addition, in addition to the PASN process, the unicast and multicast control frame key suite is indicated in RSNE in other processes; in addition to the PASN process, the PTK is used to generate TCK and KEK in other processes. On this basis, the security and reliability of transmission between network devices are improved.

[0128] In one embodiment, the first secret key generation information includes first public key information, and the second secret key generation information includes second public key information;

[0129] Alternatively, the first secret key generation information includes a first random number; and the second secret key generation information includes a second random number.

[0130] In one embodiment, the first network device includes a first site or a first access point or a first multi-link access point or a first multi-link site; the second network device includes a second site or a second access point or a second multi-link site or a second multi-link access point.

[0131] In one embodiment, the first information frame and the second information frame further include a robust security network element RSNE and an extended robust security network element RSNXE;

[0132] Alternatively, the second information frame and the third information frame further include a robust security network element RSNE and an extended robust security network element RSNXE.

[0133] In one embodiment, the first information frame includes a first authentication frame; the second information frame includes a second authentication frame; and the third information frame includes a third authentication frame.

[0134] In one embodiment, the first information frame includes a first extended authentication protocol frame; the second information frame includes a second extended authentication protocol frame; and the third information frame includes a third extended authentication protocol frame.

[0135] In one embodiment, the first authentication frame and the second authentication frame further include indication information, wherein the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicates that the second network device is a slave network device or a master network device.

[0136] In one embodiment, the device further comprises:

[0137] The first master-slave determination module is configured to determine whether the first network device is a master network device or a slave network device according to a predefined field, and correspondingly determine whether the second network device is a slave network device or a master network device.

[0138] In one embodiment, the device further includes: a first transmission module, configured to

[0139] In the case where the first network device is a main network device, transmitting multicast key GK information to the second network device through the third authentication frame;

[0140] In the case where the first network device is a slave network device, receiving GK information transmitted by the second network device through the second authentication frame;

[0141] The GK information is used to encrypt or decrypt broadcast messages between network devices.

[0142] In one embodiment, the device further includes: a second transmission module, configured to

[0143] In the case where the first network device is a primary network device, transmitting the cooperation group identification information to the second network device through the third authentication frame;

[0144] When the first network device is a slave network device, the cooperation group identification information transmitted by the second network device through the second authentication frame is received.

[0145] In one embodiment, the device further includes: a decomposition module configured to:

[0146] A first key confirmation key KCK and a first key encryption key KEK are determined according to the first PTK, the first KCK is used to verify the first MIC and generate a second MIC, and the first KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

[0147] In one embodiment, the second authentication frame or the third authentication frame further includes GK information; the GK information includes at least one of the following:

[0148] A group temporary key GTK used to encrypt or decrypt multicast data frames transmitted between the first network device and the second network device, an integrity group temporary key IGTK used to encrypt or decrypt multicast management frames transmitted between the first network device and the second network device, and an integrity control temporary key used to encrypt or decrypt multicast control frames transmitted between the first network device and the second network device.

[0149] In one embodiment, generating the second MIC includes:

[0150] According to the MAC address information of the first network device, the MAC address information of the second network device, the hash value of the first pre-connection security negotiation PASN frame body, the remaining information of the third authentication frame excluding the frame header and the second MIC, the first KCK and the hash algorithm.

[0151] In one embodiment, generating a first PTK includes:

[0152] The first PTK is generated according to the MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the PMK, and a hash function.

[0153] In one embodiment, the device further comprises:

[0154] A first determining module is configured to determine at least one of the following according to the first PTK:

[0155] The first TK is used for encryption or decryption of unicast data and management frames;

[0156] A first KDK for generating secret key information;

[0157] A first temporary control key TCK used for encryption or decryption of unicast control frames;

[0158] A first KEK for encrypting or decrypting the authentication frame;

[0159] The first KCK used to verify the MIC.

[0160] In one embodiment, the first TCK and the first KEK are generated according to the KDK.

[0161] In one embodiment, the device further comprises:

[0162] The RSNE information indicates at least one of the following to the target network device:

[0163] Unicast key suite information, authentication frame key suite information, multicast management frame key suite information, unicast control frame key suite information, and multicast control frame key suite information.

[0164] In one embodiment, the device further comprises:

[0165] The key suite for the unicast control frame and the key suite for indicating the multicast control frame are indicated to the target network device through the RSNE information.

[0166] The information frame transmission device proposed in this embodiment and the information frame transmission method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to any of the above embodiments, and this embodiment has the same beneficial effects as executing the information frame transmission method.

[0167] The embodiment of the present application also provides an information frame transmission device. Fig.10 FIG. 1 is a schematic diagram of a structure of an information frame transmission device provided by an embodiment. Fig.10 As shown, the information frame transmission device includes:

[0168] A first information frame receiving module 410 is configured to receive a first information frame of a first network device, wherein the first information frame includes first frame number information and first key generation information of the first network device;

[0169] A second information frame receiving module 420, configured to generate a second PTK, wherein the second PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device;

[0170] A second generating module 430, configured to generate a first MIC according to the second PTK;

[0171] A second information frame sending module 440 is configured to send a second information frame to the first network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC;

[0172] The third information frame receiving module 450 is configured to receive a third information frame of the first network device, where the third information frame includes third frame number information and a second MIC generated by the first network device.

[0173] The information frame transmission device of this embodiment uses the PASN extended protocol to generate PTK and transfer GK. In the PASN process, the unicast control key TCK and the authentication frame encryption key KEK are generated; in the PASN process, the master / slave network device is negotiated and indicated; the unicast and multicast control frame key suite is indicated in RSNE; in the PASN process, MIC information is generated. In addition, in addition to the PASN process, the unicast and multicast control frame key suite is indicated in RSNE in other processes; in addition to the PASN process, the PTK is used to generate TCK and KEK in other processes. On this basis, the security and reliability of transmission between network devices are improved.

[0174] In one embodiment, the first information frame includes a first authentication frame; the second information frame includes a second authentication frame; the third information frame includes a third authentication frame;

[0175] Alternatively, the first information frame includes a first extended authentication protocol frame; the second information frame includes a second extended authentication protocol frame; and the third information frame includes a third extended authentication protocol frame.

[0176] In one embodiment, the first authentication frame, the second authentication frame and the third authentication frame also include indication information, and the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicate that the second network device is a slave network device or a master network device.

[0177] In one embodiment, the device further includes: a second master-slave determination module, configured to

[0178] Determine, according to a predefined field, whether the first network device is a master network device or a slave network device,

[0179] And correspondingly determine whether the second network device is a slave network device or a master network device.

[0180] In one embodiment, the device further includes: a third transmission module, configured to

[0181] In the case where the second network device is the main network device, transmitting multicast key GK information to the first network device through the second authentication frame;

[0182] In the case where the second network device is a slave network device, receiving GK information transmitted by the first network device through the third authentication frame;

[0183] The GK information is used to encrypt or decrypt broadcast messages between network devices.

[0184] In one embodiment, the device further includes: a fourth transmission module, configured to

[0185] In the case where the second network device is a primary network device, transmitting the cooperation group identification information to the first network device through the second authentication frame;

[0186] In the case where the second network device is a slave network device, the cooperation group identification information transmitted by the first network device through the third authentication frame is received.

[0187] In one embodiment, the device further includes: a decomposition module configured to:

[0188] A second KCK and a second KEK are generated according to the second PTK, the second KCK is used to calculate the first MIC, and the second KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

[0189] In one embodiment, generating a first MIC according to the second PTK includes:

[0190] According to the MAC address information of the first network device, the MAC address information of the second network device, the RSNE of the second network device, the RSNXE information of the second network device, the remaining information of the second authentication frame excluding the frame header and the first MIC, the second KCK and the hash algorithm.

[0191] In one embodiment, generating a second PTK includes:

[0192] The second PTK is generated according to the MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the PMK and a hash function.

[0193] In one embodiment, the apparatus further includes a second determining module configured to determine at least one of the following according to the second PTK:

[0194] A second TK for encryption or decryption of unicast data and management frames;

[0195] A second KDK for generating secret key information;

[0196] A second temporary control key TCK used for encrypting or decrypting unicast control frames;

[0197] A second KEK for encrypting or decrypting the authentication frame;

[0198] The second KCK is used to verify the MIC.

[0199] The information frame transmission device proposed in this embodiment and the information frame transmission method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to any of the above embodiments, and this embodiment has the same beneficial effects as executing the information frame transmission method.

[0200] The embodiment of the present application also provides a network device, Fig.11 A schematic diagram of the hardware structure of a network device provided by an embodiment, such as Fig.11 As shown, the network device provided by the present application includes a processor 510 and a memory 520; the processor 510 in the network device may be one or more, Figure 1 A processor 510 is taken as an example; the memory 520 is configured to store one or more programs; the one or more programs are executed by the one or more processors 510, so that the one or more processors 510 implement the information frame transmission method as described in the embodiment of the present application.

[0201] The network device further includes: a communication device 530 , an input device 540 and an output device 550 .

[0202] The processor 510, memory 520, communication device 530, input device 540 and output device 550 in the network device may be connected via a bus or other means. Fig.11 The example of connecting through bus is taken in the following.

[0203] The input device 540 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the network device. The output device 550 may include a display device such as a display screen.

[0204] The communication device 530 may include a receiver and a transmitter. The communication device 530 is configured to perform information transmission and reception communication according to the control of the processor 510.

[0205] The memory 520, as a computer-readable storage medium, can be configured to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the information frame transmission method described in the embodiment of the present application (for example, the first information frame sending module 310, the second information frame receiving module 320, the first generation module 330, the first verification module 340, and the third information frame sending module 350 in the information frame transmission device). The memory 520 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to the use of the network device, etc. In addition, the memory 520 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 520 may further include a memory remotely arranged relative to the processor 510, and these remote memories may be connected to the network device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0206] The embodiment of the present application also provides a storage medium, the storage medium stores a computer program, and the computer program, when executed by a processor, implements the information frame transmission method described in any of the embodiments of the present application. The method includes: sending a first information frame to a second network device, the first information frame including first frame number information and first key generation information of the first network device; receiving a second information frame of the second network device, the second information frame including second frame number information, second key generation information of the second network device and a first MIC; generating a first PTK, the first PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device; verifying the first MIC according to the first PTK and generating a second MIC; sending a third information frame, the third information frame including third frame number information and the second MIC. , or, the method includes: receiving a first information frame from a first network device, the first information frame including first frame numbering information and first key generation information of the first network device; generating a second PTK, the second PTK being used to encrypt or decrypt unicast messages between the first network device and the second network device; generating a first MIC based on the second PTK; sending a second information frame to the first network device, the second information frame including second frame numbering information, second key generation information of the second network device and the first MIC; receiving a third information frame from the first network device, the third information frame including third frame numbering information and the second MIC generated by the first network device.

[0207] The computer storage medium of the embodiment of the present application can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (Random Access Memory, RAM), a read-only memory (Read Only Memory, ROM), an erasable programmable read-only memory (ErasableProgrammable Read Only Memory, EPROM), a flash memory, an optical fiber, a portable CD-ROM, an optical storage device, a magnetic storage device, or any suitable combination of the above. The computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system or device or used in combination with it.

[0208] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to: electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system or device.

[0209] The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the above.

[0210] The computer program code for performing the operation of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and also conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).

[0211] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.

[0212] It will be appreciated by those skilled in the art that the term user terminal covers any suitable type of wireless user equipment, such as a mobile phone, a portable data processing device, a portable web browser or a vehicle-mounted mobile station.

[0213] In general, various embodiments of the present application can be implemented in hardware or dedicated circuits, software, logic or any combination thereof. For example, some aspects can be implemented in hardware, while other aspects can be implemented in firmware or software that can be executed by a controller, microprocessor or other computing device, although the present application is not limited thereto.

[0214] Embodiments of the present application may be implemented by executing computer program instructions by a data processor of a mobile device, for example in a processor entity, or by hardware, or by a combination of software and hardware. The computer program instructions may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages.

[0215] The block diagram of any logic flow in the drawings of the present application may represent program steps, or may represent interconnected logic circuits, modules and functions, or may represent a combination of program steps and logic circuits, modules and functions. A computer program may be stored in a memory. The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as but not limited to read-only memory (ROM), random access memory (RAM), optical memory devices and systems (digital versatile discs (DVD) or compact disks (CD), etc. Computer-readable media may include non-transitory storage media. The data processor may be of any type suitable for the local technical environment, such as but not limited to general-purpose computers, special-purpose computers, microprocessors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FGPAs) and processors based on multi-core processor architectures.

[0216] By way of exemplary and non-limiting examples, a detailed description of exemplary embodiments of the present application has been provided above. However, various modifications and adjustments to the above embodiments will be apparent to those skilled in the art when considered in conjunction with the accompanying drawings and claims, but will not depart from the scope of the present application. Therefore, the proper scope of the present application will be determined according to the claims.

Claims

1. A method for transmitting an information frame, applied to a first network device, characterized in that: include: Sending a first information frame to a second network device, wherein the first information frame includes first frame number information and first key generation information of the first network device; Receive a second information frame of the second network device, where the second information frame includes second frame number information, second key generation information of the second network device, and a first information integrity check code MIC; Generate a first pairwise transmission key PTK, where the first PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device; Verify the first MIC according to the first PTK and generate a second MIC; A third information frame is sent, where the third information frame includes third frame number information and the second MIC.

2. The method according to claim 1, characterized in that The first secret key generation information includes first public key information, and the second secret key generation information includes second public key information; Alternatively, the first secret key generation information includes a first random number; and the second secret key generation information includes a second random number.

3. The method according to claim 1, characterized in that: The first network device includes a first site or a first access point or a first multi-link access point or a first multi-link site; the second network device includes a second site or a second access point or a second multi-link site or a second multi-link access point.

4. The method according to claim 1, characterized in that: The first information frame and the second information frame also include a robust security network element RSNE and an extended robust security network element RSNXE; Alternatively, the second information frame and the third information frame also include RSNE and RSNXE.

5. The method according to claim 1, characterized in that The first information frame includes a first authentication frame; the second information frame includes a second authentication frame; and the third information frame includes a third authentication frame.

6. The method according to claim 1, characterized in that The first information frame includes a first extended authentication protocol frame; the second information frame includes a second extended authentication protocol frame; and the third information frame includes a third extended authentication protocol frame.

7. The method according to claim 5, characterized in that The first authentication frame, the second authentication frame and the third authentication frame also include indication information, and the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicate that the second network device is a slave network device or a master network device.

8. The method according to claim 5, characterized in that Also includes: The first network device is determined to be a master network device or a slave network device according to the predefined field, and the second network device is determined to be a slave network device or a master network device accordingly.

9. The method according to claim 7 or 8, characterized in that: Also includes: In the case where the first network device is a main network device, transmitting multicast key GK information to the second network device through the third authentication frame; In the case where the first network device is a slave network device, receiving GK information transmitted by the second network device through the second authentication frame; The GK information is used to encrypt or decrypt broadcast messages between network devices.

10. The method according to claim 7 or 8, characterized in that: Also includes: In the case where the first network device is a primary network device, transmitting the cooperation group identification information to the second network device through the third authentication frame; When the first network device is a slave network device, the cooperation group identification information transmitted by the second network device through the second authentication frame is received.

11. The method according to claim 5, characterized in that Also includes: A first key confirmation key KCK and a first key encryption key KEK are determined according to the first PTK, the first KCK is used to verify the first MIC and generate a second MIC, and the first KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

12. The method according to claim 5, characterized in that The second authentication frame or the third authentication frame also includes GK information; the GK information includes at least one of the following: A group temporary key GTK used to encrypt or decrypt multicast data frames transmitted between the first network device and the second network device, an integrity group temporary key IGTK used to encrypt or decrypt multicast management frames transmitted between the first network device and the second network device, and an integrity control temporary key used to encrypt or decrypt multicast control frames transmitted between the first network device and the second network device.

13. The method according to claim 5, characterized in that The generating the second MIC comprises: According to the MAC address information of the first network device, the MAC address information of the second network device, the hash value of the first pre-connection security negotiation PASN frame body, the remaining information of the third authentication frame excluding the frame header and the second MIC, the first KCK and the hash algorithm.

14. The method according to claim 1, characterized in that Generate the first PTK, including: The first PTK is generated according to the media access control MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the pairwise master key PMK and a hash function.

15. The method according to claim 1, characterized in that Also includes: Determine at least one of the following based on the first PTK: A first temporary key TK used for encryption or decryption of unicast data and management frames; A first key generation key KDK for generating key information; A first temporary control key TCK used for encryption or decryption of unicast control frames; A first KEK for encrypting or decrypting the authentication frame; The first KCK used to verify the MIC.

16. The method according to claim 15, characterized in that The first TCK and the first KEK are generated according to the KDK.

17. The method according to claim 1, characterized in that Also includes: The RSNE information indicates at least one of the following to the target network device: Unicast key suite information, authentication frame key suite information, multicast management frame key suite information, unicast control frame key suite information, and multicast control frame key suite information.

18. The method according to claim 1, characterized in that Also includes: The key suite for the unicast control frame and the key suite for indicating the multicast control frame are indicated to the target network device through the RSNE information.

19. An information frame transmission method, applied to a second network device, characterized in that: include: Receiving a first information frame of a first network device, wherein the first information frame includes first frame number information and first key generation information of the first network device; Generate a second pairwise transmission key PTK, where the second PTK is used to encrypt or decrypt a unicast message between the first network device and the second network device; Generate a first information integrity check MIC according to the second PTK; Sending a second information frame to the first network device, where the second information frame includes second frame number information, second key generation information of the second network device, and the first MIC; A third information frame from the first network device is received, where the third information frame includes third frame number information and a second MIC generated by the first network device.

20. The method according to claim 19, characterized in that The first information frame includes a first authentication frame; the second information frame includes a second authentication frame; the third information frame includes a third authentication frame; or, The first information frame includes a first extended authentication protocol frame; the second information frame includes a second extended authentication protocol frame; and the third information frame includes a third extended authentication protocol frame.

21. The method according to claim 20, characterized in that The first authentication frame, the second authentication frame and the third authentication frame also include indication information, and the indication information is used to indicate that the first network device is a master network device or a slave network device, and correspondingly indicate that the second network device is a slave network device or a master network device.

22. The method according to claim 20, characterized in that Also includes: Determine, according to a predefined field, whether the first network device is a master network device or a slave network device, And correspondingly determine whether the second network device is a slave network device or a master network device.

23. The method according to claim 20, characterized in that Also includes: In the case where the second network device is the main network device, transmitting multicast key GK information to the first network device through the second authentication frame; In the case where the second network device is a slave network device, receiving the GK information transmitted by the first network device through the third authentication frame; The GK information is used to encrypt or decrypt broadcast messages between network devices.

24. The method according to claim 20, characterized in that Also includes: In the case where the second network device is a primary network device, transmitting the cooperation group identification information to the first network device through the second authentication frame; In the case where the second network device is a slave network device, the cooperation group identification information transmitted by the first network device through the third authentication frame is received.

25. The method according to claim 20, characterized in that Also includes: A second KCK and a second KEK are generated according to the second PTK, the second KCK is used to calculate the first MIC, and the second KEK is used to decrypt the second authentication frame and encrypt the third authentication frame.

26. The method according to claim 20, characterized in that Generating a first MIC according to the second PTK includes: According to the MAC address information of the first network device, the MAC address information of the second network device, the RSNE of the second network device, the RSNXE information of the second network device, the remaining information of the second authentication frame excluding the frame header and the first MIC, the second KCK and the hash algorithm.

27. The method according to claim 19, characterized in that Generating the second PTK includes: The second PTK is generated according to the media access control MAC address information of the first network device, the MAC address information of the second network device, the shared key generated by the Diffie-Huffman protocol, the pairwise master key PMK and a hash function.

28. The method according to claim 19, characterized in that Also includes: Determine at least one of the following based on the second PTK: A second temporary key TK used for encryption or decryption of unicast data and management frames; A second key generation key KDK for generating key information; A second temporary control key TCK used for encrypting or decrypting unicast control frames; A second KEK for encrypting or decrypting the authentication frame; The second KCK is used to verify the MIC.

29. A network device, characterized in that: include: memory, and one or more processors; The memory is configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the information frame transmission method according to any one of claims 1 to 28.

30. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the information frame transmission method as described in any one of claims 1 to 28 is implemented.

Images