Wireless local area network system, communication method and device

Abstract

The invention provides a wireless local area network system and a communication method and device. The wireless local area network system comprises a controller, a first access point and a second access point, the first access point is associated with a first station, the second access point is associated with a second station, and the controller is used for generating a first group of temporary keys (GTKs) and sending the first GTKs to the first access point and the second access point; the first access point is used for encrypting data through the first GTK to obtain a first message, and multicasting or broadcasting the first message; the first access point is used for sending the first GTK to the first station, and the second access point is used for sending the first GTK to the second station. According to the scheme provided by the invention, the multicast or broadcast communication efficiency of the access point in the wireless local area network system can be improved.

Description

[0001] This application is a divisional application. The application number of the original application is 202210175153.4, and the original application date is February 24, 2022. The entire contents of the original application are incorporated into this application by reference. Technical Field

[0002] The present application relates to the field of wireless communications, and in particular to a wireless local area network system, a communication method and a device. Background Art

[0003] In wireless local area networks (WLANs), access points (APs) can transmit messages to stations (STAs) by unicast, multicast, or broadcast. To improve the security of communications, APs use group transient keys (GTKs) to encrypt multicast or broadcast messages. During the process of STA associating with an AP, the STA obtains the GTK from the AP. The STA uses the GTK to decrypt multicast or broadcast messages. In practical applications, in order to improve the coverage of wireless signals, a WLAN system can be formed by multiple APs.

[0004] In a WLAN system composed of multiple APs, each STA can only receive multicast or broadcast messages from the AP associated with itself, resulting in low efficiency of AP multicast or broadcast communication. Summary of the invention

[0005] The present application provides a wireless local area network system, a communication method and an apparatus. By using the same GTK, a first AP can multicast or broadcast a first message for a first STA and a second STA, thereby improving the multicast or broadcast communication efficiency of the first AP.

[0006] In a first aspect, the present application provides a WLAN system. The WLAN system includes an access controller (AC), a first AP, and a second AP. The first AP is associated with a first STA. The second AP is associated with the second STA. The AC is used to generate a first GTK and send the first GTK to the first AP and the second AP. The first AP is used to encrypt data using the first GTK, obtain a first message, and multicast or broadcast the first message. The first AP is used to send the first GTK to the first STA. The first GTK is used for the first STA to decrypt the first message according to the first GTK. The second AP is used to send the first GTK to the second STA. The first GTK is used for the second STA to decrypt the first message according to the first GTK.

[0007] In an optional manner of the first aspect, the AC is used to generate a first GTK according to a group master key (GMK), a group random number, and a medium access control (MAC) address of the AC.

[0008] In an optional manner of the first aspect, the AC is used to send a first message to a first AP and a second AP. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the first AP and the second AP, an identifier of a virtual access point (VAP) in the first AP, an identifier of the VAP in the second AP, a key replay counter, a reception sequence counter, a group random number, and an integrity group temporary key. Among them, by adding one or more of the foregoing contents, the reliability of multicast or broadcast can be improved. For example, the first AP uses the first GTK according to the identifier of the first AP in the first message. The second AP uses the first GTK according to the identifier of the second AP in the first message. The WLAN system also includes a third AP. The first message does not carry the identifier of the third AP. After receiving the first message, the third AP does not use the first GTK. The AC can also generate a second message. The second message carries the second GTK and the identifier of the third AP. The third AP uses the second GTK according to the identifier of the third AP. Therefore, by adding the identifier of the AP, the reliability of the multicast or broadcast can be improved.

[0009] In an optional manner of the first aspect, the AC is also used to send a first indication to the first AP and the second AP. The first AP is also used to turn off the automatic update of the GTK according to the first indication. The second AP is also used to turn off the automatic update of the GTK according to the first indication. When the AC is the first AP, the first AP does not need to send the first indication to the first AP. The first AP sends the first indication to the second AP. In the present application, the first indication can prevent the first AP and the second AP from automatically updating the first GTK, resulting in different GTKs for the first AP and the second AP. Therefore, the present application can improve the reliability of multicast or broadcast.

[0010] In an optional manner of the first aspect, when there is a new AP connected to the AC, the AC is also used to send a first message to the new AP. When the AC is the first AP, the first AP is also used to send the first message to the new AP. If the new AP uses the first GTK, the first AP can multicast or broadcast the first message to the STA associated with the new AP. Therefore, the present application can further improve the communication efficiency of multicast or broadcast.

[0011] In an optional manner of the first aspect, when any one of the following conditions is met, the AC is further used to send an updated first GTK to the first AP and the second AP. The conditions include: AC restart, key timer in the AC expires, the encryption mode of the AC changes from public to encrypted, and the STA using the first GTK is offline. By updating the first GTK, the security of multicast or broadcast can be improved.

[0012] In an optional manner of the first aspect, the AC is further used to update the first GTK according to the updated GMK, the updated group random number and the MAC address of the AC to obtain an updated first GTK.

[0013] In an optional manner of the first aspect, the WLAN system also includes a third AP. The AC is also used to obtain group reference information of the three APs. The three APs include a first AP, a second AP and a third AP. The AC is also used to determine that the first AP and the second AP use a first GTK based on the group reference information. The AC is also used to determine that the third AP uses a second GTK based on the group reference information. The second GTK is different from the first GTK. Among them, the distance between multiple APs in the WLAN system may be far. At this time, the AC can group multiple APs according to the group reference information. APs in the group use the same GTK, and APs in different groups use different GTKs. Therefore, the present application can improve the security of multicast or broadcast on the basis of improving the communication efficiency of multicast or broadcast.

[0014] In an optional manner of the first aspect, the AC is also used to send a second GTK to a third AP. Or, the AC is also used to send a control instruction to the third AP. The third AP is used to generate a second GTK according to the control instruction. According to the previous description, the AC can group multiple APs. For example, the first AP and the second AP belong to the first group. The third AP belongs to the second group. Different control centers may exist for different groups. For example, the control center of the first group may be the AC. The AC may be the first AP or the second AP. The control center of the second group may be the third AP. The control center is used to generate and update the GTK within the group. Therefore, by assigning different control centers to different groups, the complexity of management can be reduced.

[0015] In an optional manner of the first aspect, the grouping reference information includes channel quality information between APs, location information of STAs associated with three APs, or on-demand information of STAs associated with three APs. The channel quality information between APs includes channel quality information between any two APs among the three APs. The channel quality information between two APs characterizes the distance between the two APs to a certain extent. The distance between the two APs characterizes the channel quality information between a STA associated with one AP and another AP to a certain extent. Therefore, by grouping through the channel quality information between APs or the location information of STAs associated with three APs, the communication quality of multicast or broadcast can be improved. When the on-demand information of multiple STAs is the same, the on-demand information can be multicast or broadcast for multiple STAs through one AP. Therefore, by grouping the on-demand information, the communication efficiency of the AP can be improved.

[0016] In an optional manner of the first aspect, the second STA is also used to roam from the second AP to the first AP. The first AP is also used to encrypt data through the first GTK to obtain a second message, and multicast or broadcast the second message. The second STA is also used to decrypt the second message according to the first GTK. Among them, when the first AP and the second AP use different GTKs, after the second STA roams from the second AP to the first AP, the first AP may not be able to send the GTK of the first AP to the second STA in time. Therefore, the second STA may not be able to normally decrypt the message multicast or broadcast by the first AP. At this time, the second STA may produce abnormal behavior. For example, the second STA disconnects from the first AP and re-associates with the first AP. In the present application, the first AP and the second AP use the same GTK. Therefore, even if the first AP does not send the GTK of the first AP to the second STA in time, the second STA can use the GTK sent by the second AP to decrypt the message multicast or broadcast by the first AP. Therefore, the present application can improve the reliability of multicast or broadcast.

[0017] In an optional manner of the first aspect, the first AP and the second AP use the same basic service set identifier (BSSID). Among them, certain types of STAs may only receive messages multicast or broadcast by the associated AP according to the BSSID. If the BSSIDs of the first AP and the second AP are different, the second STA may discard the first message. By using the same BSSID, the second STA can normally receive the message multicast or broadcast by the first AP. At this time, the BSSID carried in the first message is the same as the BSSID of the second AP. Therefore, the present application can improve the compatibility with different types of STAs.

[0018] In an optional manner of the first aspect, the first message is a multicast message. The destination IP address of the first message is the IP address of the first multicast group. When the first STA belongs to the first multicast group, the first STA is used to process the decrypted first message. When the first STA does not belong to the first multicast group, the first STA is used to discard the decrypted first message. Among them, different STAs associated with an AP can belong to different multicast groups. By dividing different multicast groups by IP addresses, the flexibility of multicast can be improved. Similarly, when the second STA belongs to the first multicast group, the second STA is used to process the decrypted first message. When the second STA does not belong to the first multicast group, the second STA is used to discard the decrypted first message.

[0019] In an optional manner of the first aspect, the signal quality information between the second STA and the first AP is greater than the first threshold. According to the previous description, the present application can group APs in the WLAN system. In practical applications, the AC can also group STAs. For example, when the signal quality information between the second STA and the first AP is greater than the first threshold, the AC determines that the second STA belongs to the first multicast group. When the signal quality information between the second STA and the first AP is less than the first threshold, the AC determines that the second STA does not belong to the first multicast group. At this time, the second STA can receive multicast or broadcast messages from other APs. The other APs may be the second AP or the third AP, etc. In the present application, by grouping STAs, the communication quality of multicast or broadcast can be improved on the basis of improving the efficiency of multicast or broadcast communication.

[0020] The second aspect of the present application provides a wireless communication method. The wireless communication method includes the following steps: an AC generates a first GTK. The AC sends the first GTK to a first AP and a second AP. The first GTK is used by a first STA and a second STA to decrypt a first message multicast or broadcast by the first AP. The first AP is associated with the first STA. The second AP is associated with the second STA.

[0021] In an optional manner of the second aspect, the AC generates a first GTK according to the GMK, a group random number, and a MAC address of the AC.

[0022] In an optional manner of the second aspect, the AC sends a first message to the first AP and the second AP. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the first AP and the second AP, an identifier of a VAP in the first AP, an identifier of a VAP in the second AP, a key replay counter, a reception sequence counter, a group random number, or an integrity group temporary key.

[0023] In an optional manner of the second aspect, the wireless communication method further includes the following steps: the AC sends a first instruction to the first AP and the second AP. The first instruction is used for the first AP and the second AP to close the automatic update of the GTK according to the first instruction.

[0024] In an optional manner of the second aspect, when any one of the following conditions is met, the wireless communication method further includes the following steps: the AC sends an updated first GTK to the first AP and the second AP. The conditions include: the AC is restarted, the key timer in the AC times out, the encryption mode of the AC is changed from public to encrypted, and the STA using the first GTK is offline.

[0025] In an optional manner of the second aspect, the wireless communication method further includes the following steps: the AC updates the first GTK according to the updated GMK, the updated group random number and the MAC address of the AC to obtain an updated first GTK.

[0026] In an optional manner of the second aspect, before the AC sends the first message to the first AP and the second AP, the wireless communication method further includes the following steps: the AC obtains group reference information of three APs. The three APs include the first AP, the second AP, and the third AP. The AC determines that the first AP and the second AP use a first GTK based on the group reference information. The AC determines that the third AP uses a second GTK based on the group reference information. The second GTK is different from the first GTK.

[0027] In an optional manner of the second aspect, after the AC determines that the third AP uses the second GTK according to the group reference information, the wireless communication method further includes the following steps: the AC sends the second GTK to the third AP. Or, the AC sends a control indication to the third AP. The control indication is used for the third AP to generate the second GTK according to the control indication.

[0028] In an optional manner of the second aspect, the group reference information includes channel quality information between APs, location information of STAs associated with the three APs, or on-demand information of STAs associated with the three APs. The channel quality information between APs includes channel quality information between any two APs among the three APs.

[0029] In an optional manner of the second aspect, after the second STA roams from the second AP to the first AP, the first GTK is also used by the second STA to decrypt the second message multicast or broadcast by the first AP according to the first GTK. The first GTK is received by the second STA from the second AP.

[0030] In an optional manner of the second aspect, the first AP and the second AP use the same BSSID.

[0031] In an optional manner of the second aspect, signal quality information between the second STA and the first AP is greater than a first threshold.

[0032] In an optional manner of the second aspect, when there is a new AP connected to the AC, the wireless communication method further includes the following steps: the AC sends a first message to the new AP.

[0033] A third aspect of the present application provides a wireless communication method. The wireless communication method includes the following steps: a first AP receives a first message from an AC. The first message includes a first GTK. The first AP encrypts data through the first GTK to obtain a first message. The first AP multicasts or broadcasts the first message. The first AP sends the first GTK to the first STA. The first GTK is used by the first STA to decrypt the first message according to the first GTK. The first AP is associated with the first STA. The first AP and the second AP use the same first GTK. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA is associated with the second AP.

[0034] In an optional manner of the third aspect, the first message also includes at least one of the following: an identifier of the first AP and the second AP, an identifier of the VAP in the first AP, an identifier of the VAP in the second AP, a key replay counter, a receive sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0035] In an optional manner of the third aspect, the wireless communication method further includes the following steps: the first AP receives a first instruction sent by the AC, and the first AP turns off automatic update of the GTK according to the first instruction.

[0036] In an optional manner of the third aspect, after the second STA roams from the second AP to the first AP, the wireless communication method further includes the following steps: the first AP encrypts data using the first GTK to obtain a second message. The first AP multicasts or broadcasts the second message. The first GTK is also used by the second STA to decrypt the second message according to the first GTK. The first GTK is received by the second STA from the second AP.

[0037] In an optional manner of the third aspect, the first AP and the second AP use the same BSSID.

[0038] In an optional manner of the third aspect, signal quality information between the second STA and the first AP is greater than a first threshold.

[0039] A fourth aspect of the present application provides a wireless communication method. The wireless communication method includes the following steps: a first AP generates a first GTK. The first AP encrypts data through the first GTK to obtain a first message. The first AP multicasts or broadcasts the first message. The first AP sends the first GTK to the second AP and the first STA. The first GTK is used by the first STA to decrypt the first message according to the first GTK. The first AP is associated with the first STA. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA is associated with the second AP.

[0040] In an optional manner of the fourth aspect, the first AP generating the first GTK includes: the first AP generating the first GTK according to the GMK, a group random number, and a MAC address of the first AP.

[0041] In an optional manner of the fourth aspect, the first AP sends a first message to the second AP and the first STA. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the second AP, an identifier of a VAP in the second AP, a key replay counter, a reception sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0042] In an optional manner of the fourth aspect, the wireless communication method further includes the following steps: the first AP sends a first instruction to the second AP, and the first instruction is used for the second AP to close the automatic update of the GTK according to the first instruction.

[0043] In an optional manner of the fourth aspect, after the second STA roams from the second AP to the first AP, the wireless communication method further includes the following steps: the first AP encrypts data using the first GTK to obtain a second message. The first AP multicasts or broadcasts the second message. The first GTK is also used by the second STA to decrypt the second message according to the first GTK. The first GTK is received by the second STA from the second AP.

[0044] In an optional manner of the fourth aspect, the first AP and the second AP use the same BSSID.

[0045] In an optional manner of the fourth aspect, signal quality information between the second STA and the first AP is greater than a first threshold.

[0046] A fifth aspect of the present application provides a wireless communication method. The wireless communication method includes the following steps: a second AP generates a first GTK. The second AP sends the first GTK to the first AP. The first GTK is used by the first AP to encrypt data through the first GTK to obtain a first message. The second AP sends the first GTK to the second STA. The first GTK is used by the second STA to decrypt the first message multicast or broadcast by the first AP according to the first GTK. The second STA is associated with the second AP. The first GTK is used by the first STA to decrypt the first message multicast or broadcast by the first AP. The first STA is associated with the first AP.

[0047] In an optional manner of the fifth aspect, the second AP generates the first GTK including: the second AP generates the first GTK according to the GMK, a group random number, and a MAC address of the second AP.

[0048] In an optional manner of the fifth aspect, the second AP sends a first message to the first AP. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the first AP, an identifier of a VAP in the first AP, a key replay counter, a reception sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0049] In an optional manner of the fifth aspect, the wireless communication method further includes the following steps: the second AP sends a first instruction to the first AP. The first instruction is used for the first AP to close the automatic update of the GTK according to the first instruction.

[0050] In an optional manner of the fifth aspect, the first AP and the second AP use the same BSSID.

[0051] In a sixth aspect, the present application provides a wireless communication device. The wireless communication device may be an AC. The wireless communication device includes a generation module and a sending module. The generation module is used to generate a first GTK. The sending module is used to send a first message to a first AP and a second AP. The first message includes a first GTK. The first GTK is used by the first STA and the second STA to decrypt a first message multicast or broadcast by the first AP. The first AP is associated with the first STA. The second AP is associated with the second STA.

[0052] In an optional manner of the sixth aspect, the generation module is used to generate a first GTK according to the GMK, a group random number and a MAC address of the wireless communication device.

[0053] In an optional manner of the sixth aspect, the first message also includes at least one of the following: an identifier of the first AP and the second AP, an identifier of the virtual access point VAP in the first AP, an identifier of the VAP in the second AP, a key replay counter, a receive sequence counter, a group random number, or an integrity group temporary key.

[0054] In an optional manner of the sixth aspect, the sending module is further used to send a first instruction to the first AP and the second AP. The first instruction is used for the first AP and the second AP to close the automatic update of the GTK according to the first instruction.

[0055] In an optional manner of the sixth aspect, when any one of the following conditions is met, the sending module is also used to send an updated first GTK to the first AP and the second AP; the conditions include: the wireless communication device is restarted, the key timer in the wireless communication device times out, the encryption mode of the wireless communication device is changed from public to encrypted, and the STA using the first GTK is offline.

[0056] In an optional manner of the sixth aspect, the generation module is further used to update the first GTK according to the updated GMK, the updated group random number and the MAC address of the wireless communication device to obtain an updated first GTK.

[0057] In an optional manner of the sixth aspect, the wireless communication device further includes an acquisition module and a determination module. The acquisition module is used to acquire group reference information of three APs. The three APs include a first AP, a second AP, and a third AP. The determination module is used to determine that the first AP and the second AP use a first GTK according to the group reference information. The determination module is also used to determine that the third AP uses a second GTK according to the group reference information. The second GTK is different from the first GTK.

[0058] In an optional manner of the sixth aspect, the sending module is further used to send the second GTK to the third AP. Or, the sending module is further used to send a control instruction to the third AP. The control instruction is used for the third AP to generate the second GTK according to the control instruction.

[0059] In an optional manner of the sixth aspect, the group reference information includes channel quality information between APs, location information of STAs associated with the three APs, or on-demand information of STAs associated with the three APs. The channel quality information between APs includes channel quality information between any two APs among the three APs.

[0060] In an optional manner of the sixth aspect, after the second STA roams from the second AP to the first AP, the first GTK is also used by the second STA to decrypt the second message multicast or broadcast by the first AP according to the first GTK. The first GTK is received by the second STA from the second AP.

[0061] In an optional manner of the sixth aspect, the first AP and the second AP use the same BSSID.

[0062] In an optional manner of the sixth aspect, signal quality information between the second STA and the first AP is greater than a first threshold.

[0063] In an optional manner of the sixth aspect, when there is a new AP connected to the wireless communication device, the sending module is further used to send a first message to the new AP.

[0064] In a seventh aspect, the present application provides a wireless communication device. The wireless communication device may be a first AP. The wireless communication device includes a receiving module, an encryption module, and a sending module. The receiving module is used to receive a first message from an AC. The first message includes a first GTK. The encryption module is used to encrypt data using the first GTK to obtain a first message. The sending module is used to multicast or broadcast the first message. The sending module is also used to send the first GTK to a second AP and a first STA. The first GTK is used by the first STA to decrypt the first message according to the first GTK. The wireless communication device is associated with the first STA. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA is associated with a second AP.

[0065] In an optional manner of the seventh aspect, the first message also includes at least one of the following: an identifier of the first AP and the second AP, an identifier of the VAP in the first AP, an identifier of the VAP in the second AP, a key replay counter, a receive sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0066] In an optional manner of the seventh aspect, the wireless communication device further includes a closing module. The receiving module is further configured to receive a first instruction sent by the AC. The closing module is configured to close the automatic update of the GTK according to the first instruction.

[0067] In an optional manner of the seventh aspect, after the second STA roams from the second AP to the first AP, the encryption module is also used to encrypt data using the first GTK to obtain a second message. The sending module is also used to multicast or broadcast the second message. The first GTK is also used for the second STA to decrypt the second message according to the first GTK. The first GTK is received by the second STA from the second AP.

[0068] In an optional manner of the seventh aspect, the wireless communication device and the second AP use the same BSSID.

[0069] In an optional manner of the seventh aspect, signal quality information between the second STA and the wireless communication device is greater than a first threshold.

[0070] In an eighth aspect of the present application, a wireless communication device is provided. The wireless communication device may be a first AP. The wireless communication device includes a generation module, an encryption module and a sending module. The generation module is used to generate a first GTK. The encryption module is used to encrypt data by using the first GTK to obtain a first message. The sending module is used to multicast or broadcast the first message. The sending module is also used to send the first GTK to the second AP and the first STA. The first GTK is used for the first STA to decrypt the first message according to the first GTK. The first AP is associated with the first STA. The first GTK is used for the second STA to decrypt the first message according to the first GTK. The second STA is associated with the second AP.

[0071] In an optional manner of the eighth aspect, the generating module is used to generate a first GTK according to the GMK, a group random number and a MAC address of the first AP.

[0072] In an optional manner of the eighth aspect, the sending module is used to send a first message to the second AP and the first STA. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the second AP, an identifier of a VAP in the second AP, a key replay counter, a reception sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0073] In an optional manner of the eighth aspect, the sending module is further configured to send a first instruction to the second AP. The first instruction is used for the second AP to close automatic update of GTK according to the first instruction.

[0074] In an optional manner of the eighth aspect, after the second STA roams from the second AP to the first AP, the encryption module is further used to encrypt data using the first GTK to obtain a second message. The sending module is further used to multicast or broadcast the second message. The first GTK is also used for the second STA to decrypt the second message according to the first GTK. The first GTK is received by the second STA from the second AP.

[0075] In an optional manner of the eighth aspect, the first AP and the second AP use the same BSSID.

[0076] In an optional manner of the eighth aspect, signal quality information between the second STA and the first AP is greater than a first threshold.

[0077] A ninth aspect of the present application provides a wireless communication device. The wireless communication device may be a second AP. The wireless communication device includes a generation module and a sending module. The generation module is used to generate a first GTK. The sending module is used to send the first GTK to the first AP. The first GTK is used for the first AP to encrypt data through the first GTK to obtain a first message. The sending module is also used to send the first GTK to the second STA. The first GTK is used for the second STA to decrypt the first message multicast or broadcast by the first AP according to the first GTK. The second STA is associated with the second AP. The first GTK is used for the first STA to decrypt the first message multicast or broadcast by the first AP. The first STA is associated with the first AP.

[0078] In an optional manner of the ninth aspect, the generation module is used to generate a first GTK according to the GMK, a group random number and a MAC address of the second AP.

[0079] In an optional manner of the ninth aspect, the sending module is used to send a first message to the first AP. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the first AP, an identifier of a VAP in the first AP, a key replay counter, a reception sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0080] In an optional manner of the ninth aspect, the sending module is further used to send a first instruction to the first AP. The first instruction is used for the first AP to close the automatic update of the GTK according to the first instruction.

[0081] In an optional manner of the ninth aspect, the first AP and the second AP use the same BSSID.

[0082] In the tenth aspect of the present application, an AC is provided. The AC includes a processor and a transceiver. The processor is used to generate a first GTK. The transceiver is used to send a first message to a first AP and a second AP. The first message includes a first GTK. The first GTK is used by a first STA and a second STA to decrypt a first message multicast or broadcast by the first AP. The first AP is associated with the first STA. The second AP is associated with the second STA.

[0083] In an optional manner of the tenth aspect, the processor is configured to generate a first GTK based on the GMK, a group random number, and a MAC address of the wireless communication device.

[0084] In an optional manner of the tenth aspect, the first message also includes at least one of the following: an identifier of the first AP and the second AP, an identifier of the virtual access point VAP in the first AP, an identifier of the VAP in the second AP, a key replay counter, a reception sequence counter, a group random number, or an integrity group temporary key.

[0085] In an optional manner of the tenth aspect, the transceiver is further used to send a first instruction to the first AP and the second AP. The first instruction is used for the first AP and the second AP to close automatic update of GTK according to the first instruction.

[0086] In an optional manner of the tenth aspect, when any one of the following conditions is met, the transceiver is also used to send an updated first GTK to the first AP and the second AP; the conditions include: the wireless communication device is restarted, the key timer in the wireless communication device times out, the encryption mode of the wireless communication device is changed from public to encrypted, and the STA using the first GTK is offline.

[0087] In an optional manner of the tenth aspect, the processor is further used to update the first GTK according to the updated GMK, the updated group random number and the MAC address of the wireless communication device to obtain an updated first GTK.

[0088] In an optional manner of the tenth aspect, the processor is further used to obtain group reference information of three APs. The three APs include a first AP, a second AP, and a third AP. The processor is further used to determine that the first AP and the second AP use a first GTK according to the group reference information. The processor is further used to determine that the third AP uses a second GTK according to the group reference information. The second GTK is different from the first GTK.

[0089] In an optional manner of the tenth aspect, the transceiver is further used to send the second GTK to the third AP. Or, the transceiver is further used to send a control instruction to the third AP. The control instruction is used for the third AP to generate the second GTK according to the control instruction.

[0090] In an optional manner of the tenth aspect, the group reference information includes channel quality information between APs, location information of STAs associated with the three APs, or on-demand information of STAs associated with the three APs. The channel quality information between APs includes channel quality information between any two APs among the three APs.

[0091] In an optional manner of the tenth aspect, after the second STA roams from the second AP to the first AP, the first GTK is also used by the second STA to decrypt the second message multicast or broadcast by the first AP according to the first GTK. The first GTK is received by the second STA from the second AP.

[0092] In an optional manner of the tenth aspect, the first AP and the second AP use the same BSSID.

[0093] In an optional manner of the tenth aspect, signal quality information between the second STA and the first AP is greater than a first threshold.

[0094] In an optional manner of the tenth aspect, when there is a new AP connected to the wireless communication device, the sending module is further used to send a first message to the new AP.

[0095] In the eleventh aspect of the present application, a first AP is provided. The first AP includes a processor and a transceiver. The transceiver is used to receive a first message from an AC. The first message includes a first GTK. The processor is used to encrypt data by using the first GTK to obtain a first message. The transceiver is used to multicast or broadcast the first message. The transceiver is also used to send the first GTK to a first STA. The first GTK is used by the first STA to decrypt the first message according to the first GTK. The first AP is associated with the first STA; wherein the first AP and the second AP use the same first GTK. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA is associated with the second AP.

[0096] In an optional manner of the eleventh aspect, the first message also includes at least one of the following: an identifier of the first AP and the second AP, an identifier of the VAP in the first AP, an identifier of the VAP in the second AP, a key replay counter, a receive sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0097] In an optional manner of the eleventh aspect, the transceiver is further configured to receive a first instruction sent by the AC. The processor is further configured to disable automatic update of the GTK according to the first instruction.

[0098] In an optional manner of the eleventh aspect, after the second STA roams from the second AP to the first AP, the processor is further used to encrypt data using the first GTK to obtain a second message. The transceiver is also used to multicast or broadcast the second message. The first GTK is also used for the second STA to decrypt the second message according to the first GTK. The first GTK is received by the second STA from the second AP.

[0099] In an optional manner of the eleventh aspect, the first AP and the second AP use the same BSSID.

[0100] In an optional manner of the eleventh aspect, signal quality information between the second STA and the first AP is greater than a first threshold.

[0101] The twelfth aspect of the present application provides a first AP. The first AP includes a processor and a transceiver. The processor is used to generate a first GTK. The processor is used to encrypt data using the first GTK to obtain a first message. The transceiver is used to multicast or broadcast the first message. The transceiver is also used to send the first GTK to a second AP and a first STA. The first GTK is used by the first STA to decrypt the first message according to the first GTK. The first AP is associated with the first STA. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA is associated with the second AP.

[0102] In an optional manner of the twelfth aspect, the processor is configured to generate a first GTK according to the GMK, a group random number, and a MAC address of the first AP.

[0103] In an optional manner of the twelfth aspect, the transceiver is used to send a first message to the second AP and the first STA. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the second AP, an identifier of a VAP in the second AP, a key replay counter, a reception sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0104] In an optional manner of the twelfth aspect, the transceiver is further configured to send a first instruction to the second AP. The first instruction is used for the second AP to disable automatic update of the GTK according to the first instruction.

[0105] In an optional manner of the twelfth aspect, after the second STA roams from the second AP to the first AP, the processor is further used to encrypt data using the first GTK to obtain a second message. The transceiver is also used to multicast or broadcast the second message. The first GTK is also used for the second STA to decrypt the second message according to the first GTK. The first GTK is received by the second STA from the second AP.

[0106] In an optional manner of the twelfth aspect, the first AP and the second AP use the same BSSID.

[0107] In an optional manner of the twelfth aspect, signal quality information between the second STA and the first AP is greater than a first threshold.

[0108] In the thirteenth aspect of the present application, a second AP is provided. The second AP includes a processor and a transceiver. The processor is used to generate a first GTK. The transceiver is used to send the first GTK to the first AP. The first GTK is used for the first AP to encrypt data through the first GTK to obtain a first message. The transceiver is also used to send the first GTK to the second STA. The first GTK is used for the second STA to decrypt the first message multicast or broadcast by the first AP according to the first GTK. The second STA is associated with the second AP. The first GTK is used for the first STA to decrypt the first message multicast or broadcast by the first AP. The first STA is associated with the first AP.

[0109] In an optional manner of the thirteenth aspect, the processor is configured to generate a first GTK according to the GMK, a group random number, and a MAC address of the second AP.

[0110] In an optional manner of the thirteenth aspect, the transceiver is used to send a first message to the first AP. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the first AP, an identifier of a VAP in the first AP, a key replay counter, a reception sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0111] In an optional manner of the thirteenth aspect, the transceiver is further configured to send a first instruction to the first AP. The first instruction is used for the first AP to disable automatic update of the GTK according to the first instruction.

[0112] In an optional manner of the thirteenth aspect, the first AP and the second AP use the same BSSID.

[0113] In the fourteenth aspect of the present application, there is provided a computer storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in the second aspect or any one of the embodiments of the second aspect; or the computer executes the method as described in the third aspect or any one of the embodiments of the third aspect; or the computer executes the method as described in the fourth aspect or any one of the embodiments of the fourth aspect; or the computer executes the method as described in the fifth aspect or any one of the embodiments of the fifth aspect.

[0114] In the fifteenth aspect of the present application, a computer program product is provided. When the computer program product is executed on a computer, the computer is caused to execute the method as described in the second aspect or any one of the embodiments of the second aspect; or the computer is caused to execute the method as described in the third aspect or any one of the embodiments of the third aspect; or the computer is caused to execute the method as described in the fourth aspect or any one of the embodiments of the fourth aspect; or the computer is caused to execute the method as described in the fifth aspect or any one of the embodiments of the fifth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0115] Figure 1 This is a first structural diagram of a WLAN system provided in an embodiment of the present application; Figure 2 This is a first flow chart of the wireless communication method provided in an embodiment of the present application; Figure 3 A second flow chart of the wireless communication method provided in an embodiment of the present application; Figure 4 This is a schematic diagram of the structure of the first message provided in an embodiment of the present application; Figure 5 This is a first flow chart of the STA grouping method provided in an embodiment of the present application; Figure 6 This is a second flow chart of the STA grouping method provided in an embodiment of the present application; Figure 7 A third flow chart of the wireless communication method provided in an embodiment of the present application; Figure 8 This is a fourth flow chart of the wireless communication method provided in an embodiment of the present application; Fig. 9 A second structural diagram of the WLAN system provided in an embodiment of the present application; Fig.10 This is a first structural diagram of a wireless communication device provided in an embodiment of the present application; Fig.11 This is a second structural diagram of a wireless communication device provided in an embodiment of the present application; Fig.12 A schematic diagram of the structure of a wireless communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0116] The present application provides a WLAN system, a wireless communication method and an apparatus. By using the same GTK, a first AP can multicast or broadcast a first message for a first STA and a second STA, thereby improving the multicast or broadcast communication efficiency of the first AP.

[0117] It should be understood that the terms "first", "second", etc. used in this application are only used for the purpose of distinguishing descriptions, and should not be understood as indicating or implying relative importance, nor should they be understood as indicating or implying an order. In addition, for the sake of simplicity and clarity, reference numbers and / or letters are repeated in multiple figures of this application. Repetition does not indicate that there is a strict limiting relationship between various embodiments and / or configurations. Exemplarily, the features or contents marked with dotted lines in the drawings of this application can be understood as optional operations or optional structures of the embodiments.

[0118] The WLAN system in the present application is applied to the field of wireless communications. In the field of wireless communications, in order to improve the coverage of wireless signals, a WLAN system can be formed by multiple APs. In a WLAN system composed of multiple APs, each STA can only receive multicast or broadcast messages from the AP associated with itself, resulting in low efficiency of AP multicast or broadcast communication.

[0119] To this end, the present application provides a WLAN system and a wireless communication method. Figure 1 FIG. 1 is a first structural diagram of a WLAN system provided in an embodiment of the present application. Figure 1 As shown, the WLAN system includes a first AP 101 and a second AP 102. The first AP 101 is associated with a first STA 103. The second AP 102 is associated with a second STA 104. In practical applications, the WLAN system may further include an AC 105. The AC 105 is connected to the first AP 101 and the second AP 102 in a wireless or wired manner. Figure 1 On the basis of Figure 2 This is a first flow chart of the wireless communication method provided in the embodiment of the present application. Figure 2 As shown, the wireless communication method includes the following steps.

[0120] In step 201, the first AP sends a first GTK to the first STA. The first AP 101 may generate the first GTK by the following formula. GTK=PRF(GMK+GNonce+MAC(AA)). PRF is a pseudo random function. Gnonce is a group random number generated by the first AP 101. MAC(AA) is the BSSID of the first AP 101. GMK is generated by the first AP 101 according to the multicast session key (MSK). The first AP 101 may generate the MSK during the pre-shared key (PSK) authentication process. Alternatively, the first AP 101 may receive the first GTK from the second AP 102. When the WLAN system further includes an AC 105, the first AP 101 may receive the first GTK from the AC 105. Alternatively, the first AP 101 may receive information for generating the GTK from the AC 105. The first AP 101 generates the first GTK according to the information for generating the GTK. The information for generating the GTK may include a group random number, a GMK, and a MAC address of the AC 105. The first AP 101 associates with the first STA 103. After acquiring the first GTK, the first AP 101 sends the first GTK to the first STA 103.

[0121] In step 202, the second AP transmits the first GTK to the second STA. When the first AP 101 generates the first GTK, the second AP 102 may receive the first GTK from the first AP 101. Alternatively, the second AP 102 receives information from the first AP 101 that the first AP 101 generates the first GTK. The second AP 102 generates the first GTK according to the information for generating the first GTK. Similarly, when the WLAN system further includes the AC 105, the second AP 102 may receive the first GTK or the information for generating the GTK from the AC 105. The second AP obtains the same first GTK as the first AP. The first AP 101 is associated with the first STA 103. After obtaining the first GTK, the second AP 102 sends the first GTK to the second STA 104. It should be understood that there is no strictly defined timing relationship between step 201 and step 202.

[0122] In step 203, the first AP encrypts data according to the first GTK to obtain a first message. The first message is a multicast message or a broadcast message. When the first message is a multicast message, the destination MAC address of the first message may be a multicast MAC address. The multicast MAC address includes six bytes. The least significant bit of the first byte of the six bytes is 1. The destination IP address of the first message may be a multicast Internet Protocol (IP) address. When the first message is a broadcast message, the destination MAC address of the first message may be a broadcast MAC address. The broadcast MAC address includes six bytes. Each bit of the six bytes is 1. The broadcast IP address of the first message may be a broadcast IP address.

[0123] In step 204, the first AP multicasts or broadcasts the first message.

[0124] In step 205, the first STA decrypts the first message according to the first GTK. After receiving the first message, the first STA 103 can read the destination MAC address in the first message. When the destination MAC address in the first message is a broadcast MAC address, the first STA 103 decrypts the first message according to the first GTK. When the destination MAC address in the first message is a multicast MAC address, the first STA 103 determines whether it belongs to the multicast group corresponding to the multicast MAC address. When the first STA 103 belongs to the multicast group corresponding to the multicast MAC address, the first STA 103 decrypts the first message according to the first GTK. When the first STA 103 does not belong to the multicast group corresponding to the multicast MAC address, the first STA 103 can discard the first message. After decrypting the first message, the first STA 103 can obtain the destination IP address of the first message. If the destination IP address in the first message is a broadcast IP address, the first STA 103 can process the decrypted first message. When the destination IP address in the first message is a multicast IP address, the first STA 103 determines whether it belongs to the multicast group corresponding to the multicast IP address. When the first STA 103 belongs to the multicast group corresponding to the multicast IP address, the first STA 103 can process the decrypted first message. When the first STA 103 does not belong to the multicast group corresponding to the multicast IP address, the first STA 103 can discard the decrypted first message.

[0125] In step 206, the second STA decrypts the first message according to the first GTK. For the description of step 206, reference may be made to the description of the aforementioned step 205. It should be understood that there is no strictly defined timing relationship between step 205 and step 206.

[0126] In the present application, the first AP 101 and the second AP 102 use the same GTK. Therefore, the first AP can multicast or broadcast the first message for the first STA and the second STA, thereby improving the communication efficiency of the first AP multicast or broadcast.

[0127] In actual applications, STAs may roam between multiple APs in a WLAN system. Figure 2 In the example, the second STA 104 can roam from the second AP 102 to the first AP 101. After the second STA 104 roams to the first AP 101, the first AP 101 encrypts data using the first GTK to obtain a second message. The first AP 101 multicasts or broadcasts the second message. The second STA 104 can decrypt the second message based on the first GTK received from the second AP 102.

[0128] In actual applications, the first AP 101 and the second AP 102 may use the same BSSID. The second STA 104 may determine to use the first GTK to decrypt the first message based on the same BSSID. It should be understood that when the BSSIDs of the first AP 101 and the second AP 102 are different, the second AP 102 may send an indication to the second STA 104. The indication includes the BSSID of the first AP 101. The second STA 104 may determine to use the first GTK to decrypt the first message based on the indication. It should be understood that when the second AP 102 has multiple VAPs, the first AP 101 may use the same BSSID as a certain VAP among the multiple VAPs.

[0129] According to the above description, the first AP 101 and the second AP 102 can obtain the first GTK in various ways. In the following embodiments, the AC 105 generating the first GTK will be described as an example. It should be understood that in the following examples, the steps performed by the AC 105 can be performed by the first AP 101 or the second AP 102. Moreover, when the first AP 101 or the second AP 102 performs the steps performed by the AC 105, the first AP 101 or the second AP 102 does not need to perform the information interaction steps with itself. For example, in Figure 2 In the embodiment, when the first AP 101 generates the first GTK, the first AP 101 does not need to send the first GTK to the first AP 101.

[0130] A key timer may be set in the first AP 101 and the second AP 102. After the key timer times out, the first AP 101 and the second AP 102 may each update the first GTK. However, the first GTK updated by the first AP 101 and the first GTK updated by the second AP 102 may be different, resulting in the second STA 104 being unable to normally decrypt the message multicast or broadcast by the first AP 101. Therefore, in the embodiment of the present application, the AC 105 may uniformly update the first GTK. Figure 3 FIG. 2 is a second flow chart of the wireless communication method provided in the embodiment of the present application. Figure 3 As shown, the wireless communication method includes the following steps.

[0131] In step 301, the AC sends a first indication to the first AP and the second AP. The embodiment of the present application does not limit the manner in which the AC 105 sends the first indication and the format of the first indication. The AC 105 may send the first indication by unicast, multicast or broadcast. The format of the first indication may be agreed upon by the AC 105 and the AP.

[0132] In step 302, the first AP turns off the automatic update of the GTK according to the first indication. After receiving the first indication, the first AP 101 can turn off the key timer for updating the GTK. Alternatively, the first AP 101 can release the relationship between the key timer timeout and the GTK update. That is, after the key timer times out, the first AP 101 does not update the GTK. It should be understood that when the first AP 101 includes multiple VAPs, the first AP 101 can turn off the automatic update of the GTK only in the target VAP. The target VAP uses the first GTK. For example, the first AP 101 includes the first VAP and the second VAP. The first VAP uses the first GTK. The second VAP uses the third GTK. The first AP 101 can turn off the automatic update of the GTK only in the first VAP. At this time, after the key timer times out, the first AP 101 can still update the GTK in the second VAP.

[0133] In step 303, the second AP turns off the automatic update of GTK according to the first instruction. For the description of step 303, reference may be made to the description of the aforementioned step 302. It should be understood that there is no strict time sequence limitation between step 302 and step 303.

[0134] In step 304, the AC sends a first GTK to the first AP and the second AP. The AC may generate the first GTK based on the GMK, the group random number, and the MAC address of AC 105. After generating the first GTK, AC 105 sends the first GTK to the first AP 101 and the second AP 102. The first GTK may be carried in the first message. The embodiment of the present application does not limit the manner in which AC 105 sends the first message and the format of the first message. For example, Figure 4 This is a schematic diagram of the structure of the first message provided in the embodiment of the present application. Figure 4 As shown, the first message 401 includes a protocol version information field, a message type field, a message size field, an AP ID field, a VAP ID field, a GTK field, a key replay counter field, a receive sequence counter (RSC) field, a group nonce (Gnonce) field, an integrity group transient key (IGTK) field, and a reserved field.

[0135] The protocol version information field can be used to indicate that the first message is a GTK synchronization message. The message type field is used to record the type of the first message, for example, the type of the first message is a control message. The message size field is used to record the data size of the first message. The AP ID field is used to record the identifier of the AP using the first GTK. For example, in an embodiment of the present application, the AP ID field includes the identifiers of the first AP 101 and the second AP 102. The VAP ID field records the identifier of the VAP using the first GTK. For example, the first VAP in the first AP 101 uses the first GTK. At this time, the VAP ID field includes the identifier of the first VAP. The GTK field is used to record the first GTK. The key replay counter field is used to record the serial number of the first GTK. The serial number of the first GTK is used to prevent an attacker from attacking the system by intercepting a key exchange data packet and replaying it. The receive counter field carries an RSC value. The RSC value can be used to synchronize the replay state. The RSC value can announce the TKIP sequence counter (TSC) value of the temporary key integrity protocol (TKIP) of the frame that has failed the message integrity code (MIC) check. The first AP 101 or the second AP 102 can identify the replayed first message based on the RSC value. The group random number field records the group random number used to generate the first GTK. The integrity group temporary key field carries verification information. The first AP 101 or the second AP 102 can verify the integrity of the first message based on the verification information. The reserved field is also called a reserved field.

[0136] In step 305, AC updates the first GTK. AC 105 may update the GMK to obtain an updated GMK. AC 105 may also update the group random number to obtain an updated group random number. AC 105 generates an updated first GTK based on the updated GMK, the updated group random number, and the MAC address of AC 105.

[0137] In step 306, the AC sends the updated first GTK to the first AP 101 and the second AP 102. When any one or more of the following conditions are met, the AC 105 sends the updated first GTK to the first AP 101 and the second AP 102. The conditions include: the AC 105 is restarted, the key timer in the AC 105 times out, the encryption mode of the AC 105 is changed from public to encrypted, and the STA using the first GTK is offline. A key timer may be set in the AC 105. After the key timer times out, the AC 105 sends the updated first GTK to the first AP 101 and the second AP 102. The STA using the first GTK may be a STA associated with the first AP 101 or the second AP 102. For example, when the first STA 103 is offline, the AC 105 sends the updated first GTK to the first AP 101 and the second AP 102.

[0138] It should be understood that the updated first GTK can be carried in the updated first message. For the description of the first message, please refer to the aforementioned Figure 4 In the subsequent description, the description of the GTK sent by one device to another device can refer to the description of the first message in the embodiment of the present application.

[0139] It should be understood that Figure 3 In the embodiment of the present application, the first AP 101 and the second AP 102 are used as examples for description. In practical applications, more APs in the WLAN system may use the same first GTK. Furthermore, when a new AP is connected to the AC 105, the AC 105 may send the first GTK to the new AP.

[0140] In an embodiment of the present application, the first AP 101 can multicast or broadcast the first message to the second STA 104. And, the second STA 104 is not associated with the first AP 101. Therefore, the channel quality information between the second STA 104 and the first AP 101 will affect the communication quality of the multicast or broadcast. To this end, AC 105 can group all STAs to obtain N groups. The number of N groups corresponds to the N APs one by one. All STAs include STAs associated with any one of the N APs. The AP only multicasts or broadcasts to the corresponding STA. The following description takes N equals two as an example, and the two APs include the first AP 101 and the second AP 102. For example, Figure 5 1 is a first flow chart of the STA grouping method provided in an embodiment of the present application. The wireless communication method may include the STA grouping method. Figure 5 As shown, the STA grouping method includes the following steps.

[0141] In step 501, the AC obtains STA grouping reference information from the first AP and the second AP. The STA grouping reference information may include channel quality information between all STAs and N APs. Figure 5 In the example, N APs include a first AP 101 and a second AP 102. All STAs include a first STA 103, a second STA 104, and a third STA. The first STA 103 is associated with the first AP 101. The second STA 104 and the third STA are associated with the second AP 102. The STA grouping reference information includes channel quality information between the first STA 103 and the first AP 101 and the second AP 102. The STA grouping reference information also includes channel quality information between the second STA 104 and the first AP 101 and the second AP 102. The STA grouping reference information also includes channel quality information between the third STA and the first AP 101 and the second AP 102. The channel quality information may be a received signal strength indication (RSSI), an interference duty cycle, or noise, etc.

[0142] In step 502, AC groups all STAs according to STA grouping reference information to obtain STA grouping information. AC 105 can group all STAs according to different methods. For example, Figure 6 FIG. 2 is a second flow chart of the STA grouping method provided in the embodiment of the present application. Figure 6 As shown, the STA grouping method includes the following steps.

[0143] In step 5020, start.

[0144] In step 5021, AC 105 sorts N APs and takes the first AP as the current AP. For example, AC 105 may obtain load information or channel status information from the first AP 101 and the second AP 102. AC 105 sorts according to the load or channel status of the first AP 101 and the second AP 102. The load information may include an idle duty cycle. AC 105 may sort in descending order according to the idle duty cycle. For example, the idle duty cycle of the first AP 101 is greater than the idle duty cycle of the second AP 102. The first AP 101 is sorted first. AC 105 takes the first AP 101 as the current AP.

[0145] In step 5022, the AC obtains the channel quality information between all STAs and the current AP. Figure 5In step 501, AC 105 obtains STA grouping reference information. The STA grouping reference information includes channel quality information between all STAs and the current AP. The channel quality information between all STAs and the current AP includes channel quality information between the first AP 101 and the first STA 103, the second STA 104, and the third STA.

[0146] In step 5023, the AC establishes a mapping relationship between the current STA and the current AP, and the channel quality information between the current STA and the current AP is greater than the first threshold. Assume that the channel quality information between the first AP 101 and the first STA 103 and the second STA 104 is greater than the first threshold. The channel quality information between the first AP 101 and the third STA is less than or equal to the first threshold. At this time, the current STA includes the first STA 103 and the second STA 104. The first AP 101 corresponds to the first STA 103 and the second STA 104. The first STA 103 and the second STA 104 can also be referred to as the first multicast group.

[0147] In step 5024, the AC determines whether to traverse N APs. The N APs also include the second AP 102. Therefore, the AC 105 determines that the N APs are not traversed. The AC 105 performs step 5025.

[0148] In step 5025, the AC uses the next AP as the current AP. The AC uses the second AP 102 as the current AP.

[0149] In step 5026, the AC obtains the channel quality information between the remaining STAs and the current AP. Figure 5 In step 501, AC 105 obtains STA grouping reference information. The STA grouping reference information includes channel quality information between the remaining STAs and the current AP. The channel quality information between the remaining STAs and the current AP includes channel quality information between the second AP 102 and the third STA.

[0150] In step 5023, the AC establishes a mapping relationship between the current STA and the current AP, and the channel quality information between the current STA and the current AP is greater than the first threshold. Assume that the channel quality information between the second AP 102 and the third STA is greater than the first threshold. At this time, the current STA includes the third STA. The second AP 103 corresponds to the third STA. The third STA can also be called a second multicast group.

[0151] In step 5024, the AC determines whether to traverse N APs. The AC determines to traverse N APs. The AC 105 executes step 5027.

[0152] In step 5027, end.

[0153] In step 503, the AC sends STA grouping information of the STA to the second AP. The STA grouping information includes information of the first multicast group and information of the second multicast group. Figure 6 As can be seen from the description, the second STA 104 belongs to the first multicast group. The third STA belongs to the second multicast group. The information of the multicast group may be an IP address of the multicast group or a MAC address of the multicast group. For example, the information of the first multicast group is the IP address of the first multicast group. The information of the second multicast group is the IP address of the second multicast group.

[0154] In step 504, the second AP sends information of the first multicast group to the second STA.

[0155] In step 505, the second AP sends information of the second multicast group to the third STA. When the information of the first multicast group is the IP address of the first multicast group and the information of the second multicast group is the IP address of the second multicast group, the second AP 102 also sends the first GTK to the third STA and the second STA 104. The third STA receives the multicast or broadcast message from the second AP 102. The third STA decrypts the multicast or broadcast message according to the first GTK. The destination IP address of the multicast or broadcast message is the IP address of the second multicast group. The third STA also processes the decrypted multicast or broadcast message according to the IP address of the second multicast group. The second STA 104 receives the multicast or broadcast message from the first AP 101. The second STA 104 decrypts the multicast or broadcast message according to the first GTK. The destination IP address of the multicast or broadcast message is the IP address of the first multicast group. The second STA 104 also processes the decrypted multicast or broadcast message according to the IP address of the first multicast group. After the second STA 104 receives the multicast or broadcast message sent by the second AP 102, the second STA 104 can decrypt the multicast or broadcast message. However, since the destination IP address of the multicast or broadcast message is the IP address of the second multicast group, the second STA 104 can discard the decrypted multicast or broadcast message. Similarly, after the third STA receives the multicast or broadcast message sent by the first AP 101, the second STA 104 can also discard the decrypted multicast or broadcast message.

[0156] When the information of the first multicast group is the MAC address of the first multicast group, and the information of the second multicast group is the MAC address of the second multicast group, the destination MAC address of the multicast or broadcast message sent by the second AP 102 is the MAC address of the second multicast group. The third STA receives the multicast or broadcast message from the second AP 102. The third STA decrypts the multicast or broadcast message according to the first GTK. The destination MAC address of the multicast or broadcast message sent by the first AP 101 is the MAC address of the first multicast group. The second STA 104 receives the multicast or broadcast message from the first AP 101. The second STA 104 decrypts the multicast or broadcast message according to the first GTK. The third STA can discard the multicast or broadcast message sent by the first AP 101 according to the MAC address of the first multicast group. Similarly, the second STA 104 can discard the multicast or broadcast message sent by the second AP 102 according to the MAC address of the second multicast group.

[0157] In step 506, the AC sends STA grouping information to the first AP. For the description of step 506, reference may be made to the description of step 503 above.

[0158] In step 507, the first AP sends information of the first multicast group to the first STA.

[0159] When the information of the first multicast group is the IP address of the first multicast group, the first AP 101 also sends a first GTK to the first STA 103. The first STA 103 receives a multicast or broadcast message from the first AP 101. The first STA 103 decrypts the multicast or broadcast message according to the first GTK. The destination IP address of the multicast or broadcast message is the IP address of the first multicast group. The first STA 103 also processes the decrypted multicast or broadcast message according to the IP address of the first multicast group. After the first STA 103 receives the multicast or broadcast message sent by the second AP 102, the first STA 103 can decrypt the multicast or broadcast message according to the first GTK. However, since the destination IP address of the multicast or broadcast message sent by the second AP 102 is the IP address of the second multicast group, the first STA 103 can discard the decrypted multicast or broadcast message.

[0160] When the information of the first multicast group is the MAC address of the first multicast group, the first AP 101 also sends the first GTK to the first STA 103. The first STA 103 receives a multicast or broadcast message from the first AP 101. The destination MAC address of the multicast or broadcast message is the MAC address of the first multicast group. The first STA 103 decrypts the multicast or broadcast message according to the first GTK. After the first STA 103 receives the multicast or broadcast message sent by the second AP 102, since the destination MAC address of the multicast or broadcast message sent by the second AP 102 is the MAC address of the second multicast group, the first STA 103 can discard the multicast or broadcast message sent by the second AP 102.

[0161] It should be understood that Figure 5 There is no strictly defined timing relationship between any two steps in step 503 to step 507. Figure 6 The grouping of STAs in the example is just an example. In practical applications, those skilled in the art can group STAs according to actual conditions.

[0162] For example, N APs include the first AP 101 and the second AP 102. All STAs include the first STA 103, the second STA 104, and the third STA. In step 502, AC 105 determines that the first STA 103, the second STA 104, and the third STA belong to the first multicast group according to the STA grouping information. AC 105 determines that there is no STA in the second multicast group according to the STA grouping information. At this time, the second AP 102 does not need to send a multicast or broadcast message.

[0163] For another example, N APs include a first AP 101, a second AP 102, and a third AP. All STAs include a first STA 103, a second STA 104, a third STA, and a fourth STA. The fourth STA is associated with the third AP. In step 502, AC 105 determines that the first STA 103, the second STA 104, and the fourth STA belong to the first multicast group according to the STA grouping information. The first multicast group corresponds to the first AP 101. AC 105 determines that the third STA belongs to the second multicast group according to the STA grouping information. The second multicast group corresponds to the second AP 102. AC 105 determines that there is no STA in the third multicast group according to the STA grouping information. The third multicast group corresponds to the third AP. At this time, the first multicast group receives a multicast or broadcast message from the first AP 101. The second multicast group receives a multicast or broadcast message from the second AP 102. The third AP does not need to send a multicast or broadcast message.

[0164] In the foregoing description, the first AP 101 and the second AP 102 use the same first GTK. In actual applications, the distances between multiple APs in the WLAN system may be far. At this time, AC 105 can group multiple APs according to AP grouping reference information. AP grouping reference information is referred to as grouping reference information. APs in the same group use the same GTK, and APs in different groups use different GTKs. For example, Figure 7 FIG. 3 is a third flow chart of the wireless communication method provided in the embodiment of the present application. Figure 7 As shown, the wireless communication method includes the following steps.

[0165] In step 701, the AC obtains group reference information from the first AP, the second AP, and the third AP. The group reference information may be channel quality information between APs, location information of STAs associated with the three APs, or on-demand information of STAs associated with the three APs. The channel quality information between APs includes channel quality information between any two APs among the three APs. The three APs include the first AP 101, the second AP 102, and the third AP. The location information of STAs associated with the three APs may include location information of the first STA 103 and the second STA 104. The on-demand information of STAs associated with the three APs may include on-demand information of the first STA 103 and the second STA 104.

[0166] In step 702, the AC determines that the first AP and the second AP use the first GTK based on the group reference information, and determines that the third AP uses the second GTK based on the group reference information. The following description is taken as an example in which the group reference information is the channel quality information between APs. For example, Table 1 is a channel quality information matrix between APs provided in an embodiment of the present application. As shown in Table 1, the channel quality information measured between the first AP 101 and the second AP 102 is -60. The channel quality information measured between the first AP 101 and the third AP is NA. Similarly, the channel quality information measured between the second AP 102 and the first AP 101 is -59. The channel quality information measured between the second AP 102 and the third AP is NA.

[0167] First AP Second AP Third AP First AP -60 NA Second AP1 -59 NA Third AP2 NA NA Table 1 In Table 1, a larger value of the channel quality information indicates better channel quality information. NA indicates that the signal of the other end cannot be received. AC 105 sets the first AP 101 and the second AP 102 as the first group according to Table 1. AC 105 sets the third AP as the second group according to Table 1. The APs in the first group use the first GTK. The APs in the second group use the second GTK.

[0168] In step 703, the AC sends a first GTK to the first AP and the second AP. For a description of step 703, please refer to the aforementioned Figure 2 After the first AP 101 and the second AP 102 receive the first GTK, the first AP 101 and the second AP 102 may decrypt the first message multicast or broadcast by the first AP 101 according to the first GTK.

[0169] In step 704, the AC sends a second GTK to the third AP. For a description of AC 105 generating the second GTK, please refer to the aforementioned Figure 2 In the figure, AC 105 generates a relevant description of the first GTK. The second GTK is different from the first GTK. After receiving the second GTK, the third AP can send the second GTK to the fourth STA. The fourth STA is associated with the third AP. The third AP can encrypt data according to the second GTK to obtain a multicast or broadcast message. The fourth STA can decrypt the multicast or broadcast message through the second GTK. It should be understood that the description of the third AP and the fourth STA can refer to the description of the aforementioned first AP and the first STA. For example, AC 105 may also send a first indication to the third AP. The third AP turns off the automatic update of the GTK according to the first indication.

[0170] In the aforementioned Figure 7 In the example, AC 105 serves as the control center for both the first group and the second group. The control center is responsible for maintaining the GTK of this group. In actual applications, different groups of APs may have different control centers. For example, Figure 8 FIG. 4 is a fourth flow chart of the wireless communication method provided in the embodiment of the present application. Figure 8 As shown, the wireless communication method includes the following steps.

[0171] For the description of steps 701 to 703, please refer to the aforementioned Figure 7 The description of step 701 to step 703 in .

[0172] In step 801, the AC sends a control instruction to the third AP. The embodiment of the present application does not limit the sending method and format of the control instruction. The format of the control instruction can be agreed upon by the third AP and AC 105.

[0173] In step 802, the third AP generates a second GTK according to the control instruction. After receiving the control instruction, the third AP becomes the control center of the second group according to the control instruction. The third AP is responsible for maintaining the second GTK of the second group. For example, the third AP generates a second GTK according to the control instruction. The third AP can also send the second GTK to the fourth STA. The third AP can also update the second GTK according to the control instruction to obtain an updated second GTK. The third AP sends the updated second GTK to the fourth STA.

[0174] It should be understood that Figure 7 and Figure 8 The description is only given by taking three APs as an example. In actual applications, AC 105 may group multiple APs differently according to actual conditions. For example, the WLAN system further includes a fourth AP. AC 105 groups the third AP and the fourth AP as the second group according to the reference grouping information. Figure 8 In the process, the third AP may also send a second GTK to the fourth AP.

[0175] Fig. 9 FIG. 2 is a second structural diagram of the WLAN system provided in the embodiment of the present application. Fig. 9 As shown, the WLAN system includes a first AP 101, a second AP 102, a third AP 901, and a fourth AP 902. The circular dotted line outside the AP represents the signal coverage of the AP. The dotted line between the AP and the STA represents the association relationship. Among them, the first AP 101 is associated with STA1 and STA3. The second AP 102 is associated with STA2. The third AP 901 is associated with STA4 and STA6. The fourth AP 902 is associated with STA5.

[0176] The solid arrow line between the AP and the STA represents the transmission direction of the multicast or broadcast message. Among them, AC 105 (not shown in the figure) takes the first AP 101 and the second AP 102 as the first group. In the first group, the first AP 101 uses the first GTK to encrypt data and obtains the first message. The first AP 101 multicasts or broadcasts the first message. STA1, STA2 and STA3 decrypt the first message according to the first GTK. AC 105 takes the third AP 901 and the fourth AP 902 as the second group. In the second group, the third AP 901 uses the second GTK to encrypt data and obtains the multicast or broadcast message. STA4, STA5 and STA6 decrypt the multicast or broadcast message sent by the third AP 901 according to the second GTK.

[0177] exist Fig. 9In the embodiment, AC 105 can select an AP in the second group as the control center of the second group. AC 105 can select the control center according to the processing capacity of each AP in the second group, or the association between each AP in the second group and AC 105. For example, AC 105 uses the AP with strong processing capacity in the second group as the control center. Alternatively, AC 105 uses the AP with fewer nodes between AC 105 and AC 105 as the control center. For example, the third AP 901 is directly connected to AC 105, and the fourth AP 902 is connected to AC 105 through the first AP 101. At this time, AC 105 uses the third AP 901 as the control center of the second group.

[0178] The wireless communication method and WLAN system provided in the embodiments of the present application are described above. The wireless communication device provided in the embodiments of the present application is described below. Fig.10 FIG. 1 is a first structural diagram of a wireless communication device provided in an embodiment of the present application. Fig.10 As shown, the wireless communication device 1000 includes a generating module 1001 and a sending module 1002. The generating module 1001 is used to generate a first GTK. The sending module 1002 is used to send a first message to a first AP and a second AP. The first message includes a first GTK. The first GTK is used by a first station STA and a second STA to decrypt a first message multicast or broadcast by the first AP. The first AP is associated with the first STA. The second AP is associated with the second STA.

[0179] It should be understood that the wireless communication device 1000 may be the AC 105 in the aforementioned wireless communication method or WLAN system. Therefore, for the description in the wireless communication device 1000, reference may be made to the relevant description in the aforementioned wireless communication method or WLAN system. For example, the sending module 1002 may also be used to send a first indication to the first AP. For another example, the sending module 1002 may also be used to send an updated first GTK to the first AP.

[0180] Fig.11 This is a second structural diagram of a wireless communication device provided in an embodiment of the present application. Fig.11 As shown, the wireless communication device 1100 includes a generation module 1101, an encryption module 1102 and a sending module 1103. The generation module 1101 is used to generate a first GTK. The encryption module 1102 is used to encrypt data by using the first GTK to obtain a first message. The sending module 1103 is used to multicast or broadcast the first message. The sending module 1103 is also used to send the first GTK to the second AP and the first STA. The first GTK is used by the first STA to decrypt the first message according to the first GTK. The wireless communication device 1100 is associated with the first STA. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA is associated with the second AP.

[0181] It should be understood that the wireless communication device 1100 can be the first AP 101 in the aforementioned wireless communication method or WLAN system. Therefore, for the description in the wireless communication device 1100, reference can be made to the relevant description in the aforementioned wireless communication method or WLAN system. For example, the encryption module 1102 can also be used to encrypt data according to the first GTK to obtain a second message. The sending module 1003 can also be used to multicast or broadcast the second message. For another example, the wireless communication device 1100 can also include a receiving module and a closing module. The receiving module is used to receive a first indication from the AC. The closing module closes the automatic update of the GTK according to the first indication.

[0182] Fig.12 Schematic diagram of the structure of the wireless communication device provided in the embodiment of the present application. Fig.12 As shown, the wireless communication device 1200 includes a processor 1201 and a transceiver 1202. The wireless communication device 1200 may be an AC or a first AP in a WLAN system or a wireless communication method.

[0183] When the wireless communication device 1200 is an AC, the processor 1201 is used to generate a first GTK. The transceiver 1202 is used to send a first message to the first AP and the second AP. The first message includes the first GTK. The first GTK is used by the first STA and the second STA to decrypt the first message multicast or broadcast by the first AP. The first AP is associated with the first STA. The second AP is associated with the second STA.

[0184] It should be understood that the description of the wireless communication device 1200 may refer to the description of the wireless communication method or the WLAN system described above. The processor 1201 may also be used to execute the processing steps performed by the AC 105 in the wireless communication method described above. For example, the processor 1201 may also be used to execute Figure 3 Step 305 in step 306. For another example, the processor 1201 may also be configured to execute Figure 5 The transceiver 1202 may also be used to perform the sending or receiving steps performed by the AC 105 in the aforementioned wireless communication method. For example, the transceiver 1202 may also be used to Figure 3 Step 301 in the above. For another example, the transceiver 1202 may also be used to Figure 5 Step 501 and step 503 in .

[0185] When the wireless communication device 1200 is a first AP, the processor 1201 is used to generate a first GTK. The processor 1201 is used to encrypt data using the first GTK to obtain a first message. The transceiver 1202 is used to multicast or broadcast the first message. The transceiver 1202 is also used to send the first GTK to the second AP and the first STA. The first GTK is used by the first STA to decrypt the first message according to the first GTK. The first AP is associated with the first STA. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA is associated with the second AP.

[0186] It should be understood that the description of the wireless communication device 1200 may refer to the description of the wireless communication method or the WLAN system described above. The processor 1201 may also be used to execute the processing steps performed by the first AP 101 in the wireless communication method described above. For example, the processor 1201 may also be used to execute Figure 3 The transceiver 1202 may also be used to perform the sending or receiving steps performed by the first AP 101 in the aforementioned wireless communication method. For example, the transceiver 1202 may also be used to Figure 5 Step 504 in .

[0187] In other embodiments, the wireless communication device 1200 may further include a memory 1203. The memory 1203 may be a non-volatile memory, such as a hard disk drive (HDD), etc., or a volatile memory (volatile memory), such as a random-access memory (RAM). The memory 1203 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0188] The memory 1203 may be used to store the first GTK or the first message. The memory 1203 may also be used to store instructions so that the processor 1201 may be used to perform the steps mentioned in the aforementioned wireless communication method. Alternatively, the memory 1203 may also be used to store other instructions to configure the parameters of the processor 1201 to implement corresponding functions.

[0189] It should be understood that Fig.12 The device can also be used to execute the method steps mentioned in the embodiment variations or optional solutions shown in the aforementioned figures, which will not be described in detail here.

[0190] In the embodiment of the present application, the processor 1201 can be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware processor to be executed, or the hardware and software units in the processor can be combined and executed.

[0191] The program code executed by the processor 1201 to implement the above-mentioned wireless communication method may be stored in the memory 1203. The memory 1203 is coupled to the processor 1201. The coupling in the embodiment of the present application is an indirect coupling or communication connection between devices, units or modules, which may be electrical, mechanical or other forms, and is used for information exchange between devices, units or modules. The processor 1201 may operate in coordination with the memory 1203.

[0192] Based on the above embodiments, the embodiments of the present application further provide a computer-readable storage medium. The storage medium stores a software program, and the software program can implement the method provided by any one or more of the above embodiments when read and executed by one or more processors. The computer-readable storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and other media that can store program codes.

[0193] Based on the above embodiments, the embodiments of the present application further provide a chip. The chip includes a processor for implementing the functions involved in any one or more of the above embodiments, such as obtaining or processing the first message involved in the above method. Optionally, the chip also includes a memory for executing necessary program instructions and data by the processor. The chip can be composed of a chip, or it can include a chip and other discrete devices.

[0194] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0195] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0196] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0197] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A wireless local area network system, characterized in that: The system comprises a controller, a first access point and a second access point, wherein the first access point is associated with a first station, and the second access point is associated with a second station, wherein: The controller is used to generate a first group of temporary keys GTK, and send the first GTK to the first access point and the second access point; The first access point is used to encrypt data through the first GTK to obtain a first message, and multicast or broadcast the first message; The first access point is used to send the first GTK to the first station, and the second access point is used to send the first GTK to the second station.

2. The wireless local area network system according to claim 1, characterized in that: The controller is used to send the first GTK to the first access point and the second access point, including: the controller is used to send a first message to the first access point and the second access point, the first message including the first GTK; The first message further includes at least one of the following: identifiers of the first access point and the second access point, identifiers of virtual access points in the first access point, identifiers of virtual access points in the second access point, a key replay counter, a reception sequence counter, a group random number, and an integrity group temporary key.

3. The wireless local area network system according to claim 1, characterized in that: The controller is further configured to send a first indication to the first access point and the second access point; The first access point is further used to disable automatic update of GTK according to the first instruction; The second access point is further configured to disable automatic update of GTK according to the first instruction.

4. The wireless local area network system according to claim 1, characterized in that: When there is a new access point connected to the controller, the controller is further configured to send a first message to the new access point.

5. The wireless local area network system according to claim 1, characterized in that: The controller is used to generate a first GTK, including: the controller is used to generate the first GTK according to a group master key GMK, a group random number and a MAC address of the controller.

6. The wireless local area network system according to any one of claims 1 to 5, characterized in that: When any one of the following conditions is met, the controller is further configured to send an updated first GTK to the first access point and the second access point; The conditions include: the controller is restarted, the key timer in the controller times out, the encryption mode of the controller is changed from public to encrypted, and the site using the first GTK is offline.

7. The wireless local area network system according to claim 5, characterized in that: The controller is further configured to update the first GTK according to the updated GMK, the updated group random number and the MAC address of the controller to obtain the updated first GTK.

8. The wireless local area network system according to any one of claims 1 to 5, characterized in that: The wireless local area network system further includes a third access point; The controller is further configured to obtain grouping reference information of three access points, where the three access points include the first access point, the second access point, and the third access point; The controller is further configured to determine, according to the grouping reference information, that the first access point and the second access point use the first GTK, and the third access point uses a second GTK, where the second GTK is different from the first GTK.

9. The wireless local area network system according to any one of claims 1 to 5, characterized in that: The second station is further configured to roam from the second access point to the first access point; The first access point is further used to encrypt data by using the first GTK to obtain a second message, and multicast or broadcast the second message; The second site is further used to decrypt the second message according to the first GTK.

10. The wireless local area network system according to any one of claims 1 to 5, characterized in that: The first access point and the second access point use the same basic service set identifier BSSID.

11. The wireless local area network system according to any one of claims 1 to 5, characterized in that: The first GTK is used by the first site to decrypt the first message according to the first GTK.

12. The wireless local area network system according to claim 11, characterized in that: The first GTK is used by the second site to decrypt the first message according to the first GTK.

13. The wireless local area network system according to any one of claims 1 to 5, characterized in that: The controller is connected to the first access point and the second access point in a wired manner.

14. A communication method, characterized in that: include: The controller generates the first set of temporary keys GTK, The controller sends a first GTK to a first access point and a second access point, so that the first access point sends the first GTK to a first station and the second access point sends the first GTK to a second station, the first access point is associated with the first station, and the second access point is associated with the second station.

15. The method according to claim 14, characterized in that The controller sending the first GTK to the first access point and the second access point includes: the controller sending a first message to the first access point and the second access point, the first message including the first GTK; The first message further includes at least one of the following: identifiers of the first access point and the second access point, identifiers of virtual access points in the first access point, identifiers of virtual access points in the second access point, a key replay counter, a reception sequence counter, a group random number, or an integrity group temporary key.

16. The method according to claim 14, characterized in that The method further comprises: The controller sends a first instruction to the first access point and the second access point, where the first instruction is used for the first access point and the second access point to disable automatic update of GTK according to the first instruction.

17. The method according to claim 14, characterized in that When any of the following conditions is met, the method further includes: The controller sends an updated first GTK to the first access point and the second access point; The conditions include: the controller is restarted, the key timer in the controller times out, the encryption mode of the controller is changed from public to encrypted, and the site using the first GTK is offline.

18. The method according to claim 14, characterized in that The controller generating the first GTK includes: the controller generating the first GTK according to a group master key GMK, a group random number and a MAC address of the controller.

19. The method according to any one of claims 14 to 18, characterized in that Before the controller sends the first message to the first access point and the second access point, the method further includes: The controller acquires grouping reference information of three access points, where the three access points include the first access point, the second access point, and a third access point; The controller determines, according to the group reference information, that the first access point and the second access point use the first GTK; The controller determines, according to the group reference information, that the third access point uses a second GTK, where the second GTK is different from the first GTK.

20. The method according to any one of claims 14 to 18, characterized in that The first GTK is used by the first station to decrypt the first message sent by the first access point according to the first GTK.

21. The method according to claim 20, characterized in that The first GTK is used by the second station to decrypt the first message sent by the first access point according to the first GTK.

22. A communication device, characterized in that: It includes a generation module and a sending module, wherein: The generating module is used to generate a first group of temporary keys GTK; The sending module is used to send a first message to a first access point and a second access point, the first message including a first GTK, so that the first access point sends the first GTK to a first site and the second access point sends the first GTK to a second site, the first access point is associated with the first site, and the second access point is associated with the second site.

23. The device according to claim 22, characterized in that The first message further includes at least one of the following: an identifier of the first access point and the second access point, an identifier of a virtual access point in the first access point, an identifier of a virtual access point in the second access point, a key replay counter, a reception sequence counter, a group random number, or an integrity group temporary key.

24. The device according to claim 22, characterized in that The sending module is further used to send a first instruction to the first access point and the second access point, where the first instruction is used for the first access point and the second access point to close the automatic update of GTK according to the first instruction.

25. The device according to claim 22, characterized in that When any one of the following conditions is met, the sending module is also used to send the updated first GTK to the first access point and the second access point; the conditions include: the communication device is restarted, the key timer in the communication device times out, the encryption mode of the communication device is changed from public to encrypted, and the site using the first GTK is offline.

26. The device according to any one of claims 22 to 25, characterized in that The first GTK is used by the first station to decrypt a first message multicast or broadcast by the first access point.

27. The device according to claim 26, characterized in that The first GTK is used by the second station to decrypt the first message multicast or broadcast by the first access point.

28. The device according to any one of claims 22 to 25, characterized in that The generating module is used to generate a first GTK according to the GMK, a group random number and a MAC address of the communication device.

29. The device according to any one of claims 22 to 25, characterized in that The communication device is a controller.

30. A controller, characterized in that: The controller is used to execute the method according to any one of claims 14-21.

Images