Mobility Domain Access Point Scope Pairwise Transient Key

Abstract

The present invention relates to "Mobility Domain Access Point Scope Pairwise Transient Key." The present invention discloses a method, system and computer-readable medium for performing operations, the operations including: encrypting association data by a station in a mobility domain of a wireless communication network, wherein the encryption is performed using a pairwise transient key (PTK); and sending the encrypted association data to an AP to establish a wireless communication link.

Description

[0001] Priority claim

[0002] This application claims priority under 35 U.S.C. §119(e) to U.S. patent application serial number 63 / 541,579, filed on September 29, 2023, the entire contents of which are hereby incorporated by reference. Background Art

[0003] Many electronic devices communicate with each other using wireless local area networks (WLANs), such as those based on communication protocols for wireless local area networks (also known as "Wi-Fi") that conform to Institute of Electrical and Electronics Engineers (IEEE) standards (e.g., IEEE 802.11 standards). A WLAN may include an access point (AP) that provides one or more stations (STAs) with access to another network, such as the Internet. There are many generations of the IEEE 802.11 standard, including 802.11ax (Wi-Fi 6) and 802.11be (Wi-Fi 7).

[0004] IEEE 802.11 is a packet-based protocol. According to this protocol, a transmitter (e.g., an access point (AP)) encapsulates control information and / or user data into a protocol data unit (PDU) in a physical layer convergence protocol (PLCP). A PLCP PDU (PPDU) includes a preamble and a data field, among other fields. After generating the PPDU, the access point can transmit the PPDU to a station connected to the access point. Communication from an access point to a station is called a downlink, and communication from a station to an access point is called an uplink. Summary of the invention

[0005] The present disclosure describes a wireless communication system in which a pairwise transient key (PTK) is synchronized with all access points (APs) in a mobility domain. In the communication system described herein, a station (STA) generates a PTK only once for encryption. The following signaling in the mobility domain is encrypted. A station can use a single association signaling sequence to initialize communication links with multiple AP multi-link devices (MLDs). For example, the network may include a wireless local area network (WLAN) or a WLAN mesh network. A station can use a single association signaling process to associate with two or more access points of the network.

[0006] The station configures the address used for protected AP discovery, association, or roaming within the mobility domain. The station can send a PTK-protected scanning message (e.g., for a probe request) to transmit a ranging or measurement request to an AP in the mobility domain. The scanning message is pre-configured to use a STA address known to the AP. The AP recognizes the scanning message based on the known address, and the AP can receive the frame sent in the scanning message.

[0007] In one aspect, a station may add a link to its association with an AP MLD that belongs to a mobility domain for which the station has created a PTK. The station may not have established a communication link to the AP MLD for which it is adding a link to its association.

[0008] On the one hand, the AP MLD may include multiple APs. An AP and a station may set up a link. By using a preconfigured address in the address field of a scan message, the station assists the receiving AP MLD in detecting the station and applying the correct site-specific PTK. The preconfigured scan address is known only to a specific remote device and to the station. Site privacy is protected from attackers or other unauthorized users. For example, a station uses a scan address message to send to an AP MLD that is not yet connected to the network to assist the AP MLD in connecting to the network. When multiple links have the same AP MLD, the station can send data on multiple links. The station can also establish multiple links with other AP MLDs. The station can use the PTK for all APMLDs belonging to the same mobility domain.

[0009] In one aspect, the state diagram may illustrate one or more frame types that a STA can transmit and / or receive with a network. In the first state representing an unauthenticated, unassociated state, the STA can send and / or receive Class 1 frames. In the second state, the STA is authenticated (except for directional multi-gigabit (DMG) STAs that do not perform IEEE 802.11 authentication) and is not associated. In the second state, the authenticated STA can transmit and / or receive Class 1 and Class 2 frames. In the third state, the STA is authenticated and associated. In some instances, a STA in the third state may still be pending robust security network association (RSNA) authentication. In the third state, the STA is configured to send and / or receive Class 1, Class 2, and Class 3 frames. In addition, in some instances, a port controlled by IEEE 802.1x may be blocked, so that a STA in the third state cannot transmit frames to the Internet (or to another network outside the AP).

[0010] Once the STA has successfully completed the four-way handshake, the STA transitions to state 4. In state 4, the STA is authenticated, associated, and RSNA is established (or not required). In state 4, the STA is configured to send and / or receive class 1, class 2, and class 3 frames. In addition, the port controlled by IEEE 802.1x can be unblocked, so the STA can transmit frames to the Internet (or to another network outside the AP). In some specific implementations, the STA can directly transition from state 2 to state 4 based on one of the following alternatives. In the first alternative, the STA can perform a successful (re) association and does not require RSNA. In the second alternative, the STA can perform a personal basic service set (PBSS) four-way handshake. In the third alternative, the STA can perform a fast initial link setup (FILS) (re) association and key confirmation. In the fourth alternative, the STA can perform a fast basic service set (BSS) transition. Pairwise master keys (PMKr0 and PMKr1) can be shared between mobility domain access points (APs) to achieve fast BSS transition (FT).

[0011] In some mobility domain systems (e.g., for Wi-Fi 7), a station may operate at a first mobility domain support level or at a second mobility domain support level. At the first mobility domain support level, there is no 802.11r operation support. In such a specific implementation, the station authenticates each BSS separately, and there is no PMK sharing in the communication network. At the second mobility domain support level, the network supports fast BSS transition (FT) operation as defined in 802.11r. The station authenticates and creates a PMK with the network, and the network forwards the PMK to one or more access points in the mobility domain to enable fast transition of the BSS. The shared PMK in the second mobility domain support level enables the station to transition directly from state 2 to state 4, as described above. At support level two, the AP supports the same authentication and key management (AKM) suite value and can use the same PMK. The mobility domain implementation scheme described previously enables fast BSS transition or pre-association security negotiation (PASN) key derivation from the PMK.

[0012] Previous mobility domain systems (e.g., for Wi-Fi 7) include one or more technical limitations. Previous systems allow stations to send data on multiple links as long as the links connect the same AP MLD, but do not allow preparation or link setup with other AP MLDs. Fast BSS Transition (FT BSS) and Pre-Association Security Negotiation (PASN) derive the PTK used in pre-association encryption from the PMK. Because current association signaling only supports single PTK creation, associating a STA with an AP MLD creates a PTK used only between STAs of an MLD pair, and a STA can be associated with only one access point MLD (AP MLD). In other words, association signaling cannot create multiple PTKs, and therefore cannot cause corresponding PTKs in multiple PTKs to be used with different AP MLDs respectively. Previous systems also do not support forwarding or tunneling association signaling from one physical AP to another. AP MLD-specific PTK generation requires additional signaling overhead and may delay association or roaming.

[0013] In addition, PTK creation is authentication mechanism AKM suite specific. For example, pre-shared key, WPA3 Enterprise, and Opportunistic Wireless Encryption (OWE) networks may generate PTKs differently from each other. The AP MLDs in a mobility domain AP (MD AP) each support the same authentication mechanism and AKM, and the AP MLD supports the same signaling for all supported authentication schemes.

[0014] The systems and methods described in this specification can achieve one or more of the following advantages. A station can add one or more additional links, for example, to one or more neighboring access points in the same mobility domain. A station can add one or more communication links to one or more additional access points without setting one or more additional PTKs for those additional communication links. For example, when a station associates with a first AP MLD of a mobility domain AP, the station may only need to generate a PTK once, thereby reducing signaling overhead and simplifying key usage.

[0015] A station can establish multiple links with the same AP MLD and / or for one or more additional neighboring AP MLDs without performing a four-way handshake with each AP MLD. Using a synchronized PTK for multiple communication links in a mobility domain reduces signaling overhead because no additional four-way handshake is required to establish each communication link. Instead, a station generates a PTK only once and can use the PTK with respect to each access point associated with the mobility domain. In addition, a station can use the same association signaling with multiple AP MLDs to create links with those multiple AP MLDs.

[0016] The privacy of the station is protected by using a mobility domain AP-wide PTK. After the station has set up the PTK, the STA only transmits using encrypted management frames and may have one or more addresses that cannot be tracked when transmitted over the air. The transmission by the station including the scan address may assist the receiving AP MLD in detecting the station and applying the correct PTK. Since the one or more scan addresses are known only to the network and the station, the privacy of the station may be protected, for example, from being detected and / or tracked by unauthorized parties.

[0017] The details of one or more embodiments of these systems and methods are set forth in the following drawings and description. Other features, objects, and advantages of these systems and methods will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A block diagram illustrating an example of an electronic device that conducts wireless communications according to some implementations is illustrated.

[0019] Figure 2A An example of an address hierarchy is illustrated.

[0020] Figure 2B An exemplary diagram showing data payload encryption is illustrated.

[0021] Figure 2C An exemplary diagram showing decryption of a data payload is illustrated.

[0022] Figure 2D A flow chart showing an exemplary process for establishing a communication link in a wireless network is illustrated.

[0023] Figure 3 A flow chart showing an exemplary process for authentication used in establishing a communication link in a wireless network is illustrated.

[0024] Figure 4A A flow chart showing an exemplary process of scanning for addresses to establish a communication link in a wireless network is illustrated.

[0025] Figure 4B A flow chart showing an exemplary process of scanning for addresses to establish a communication link in a wireless network is illustrated.

[0026] FIG. 5A to FIG. 5D An exemplary communication network is illustrated, which shows an exemplary process of establishing a communication link in a wireless network using a mobility domain AP-wide PTK.

[0027] Figure 6 A flow chart showing an exemplary process for establishing a communication link in a wireless network is illustrated.

[0028] Figure 7A flow chart illustrating an exemplary method for wireless communications is illustrated.

[0029] Figure 8 A flow chart illustrating an exemplary method for wireless communications is illustrated.

[0030] Fig. 9 A block diagram of an exemplary electronic device is illustrated. DETAILED DESCRIPTION

[0031] This specification describes a wireless communication system in which a pairwise transient key (PTK) is synchronized with multiple access points (APs) in a mobility domain. In the communication system described herein, a station (STA) generates a PTK once, and subsequent signaling in the mobility domain is encrypted, for example, based on the PTK. The station can use a common association signaling sequence to initialize communication links with multiple access point (AP) multi-link devices (MLDs). For example, the network may include a wireless local area network (WLAN), and the station can associate with multiple AP MLDs using a common association signaling process. In some specific implementations, the network can be a mesh network.

[0032] The association signaling includes one or more scan addresses for the associated site. The associated site sends a PTK-protected scan message (e.g., for a probe request) by setting the transmitter address to the scan address. The associated site can request the AP MLD to add one or more links to an access point in the mobility domain for which the site has not yet established a communication link. By applying the scan address as the transmitter address, the site assists the receiving AP MLD in detecting the site and applying the correct PTK. The scan address is only known to devices in the communication network and to the site. Therefore, site privacy is protected from attackers and / or other unauthorized parties. For example, when a site sends to an AP MLD that is not yet connected to the network, the site sends one or more of the scan addresses.

[0033] Figure 1A block diagram 100 of an example of an electronic device for wireless communication according to some specific implementations is illustrated. Notably, one or more electronic devices 110 (such as a smart phone, a laptop, a notebook computer, a tablet computer, or another such electronic device) and an access point 112 can communicate wirelessly in a WLAN using the IEEE 802.11 communication protocol. Thus, the electronic device 110 can be associated with the access point 112 or can have a connection with the access point. For example, the electronic device 110 and the access point 112 can communicate wirelessly in the following situations: detect each other by scanning a wireless channel, send and receive beacons or beacon frames on the wireless channel, establish a connection (e.g., by sending a connection request), and / or send and receive packets or frames (packets or frames may include requests and / or additional information such as data as payload). It is noted that the access point 112 can provide access to a network such as the Internet via an Ethernet protocol, and can be a physical access point or a virtual or "software" access point implemented on a computer or an electronic device that performs functions other than acting as an AP. In this specification, the electronic device 110 is sometimes referred to as a "receiving electronic device" or "receiver station."

[0034] Despite providing Figure 1 The environment shown is used as an example, but in alternative implementations, there may be different numbers and / or types of electronic devices. For example, some implementations may include more or fewer electronic devices. As another example, in some implementations, different electronic devices may send and / or receive packets or frames. In some implementations, multiple links may be used during communication between electronic devices 110.

[0035] As referenced below Fig. 9 As further described, the electronic device 110 and the access point 112 may include subsystems such as a networking subsystem, a memory subsystem, and a processor subsystem. In addition, the electronic device 110 and the access point 112 may include a radio component 114 in the networking subsystem. More generally, the electronic device 110 and the access point 112 may include any electronic device with a networking subsystem (or may be included in any electronic device with a networking subsystem) that enables the electronic device 110 and the access point 112 to communicate wirelessly with each other or with another electronic device, respectively. This may include sending beacons on a wireless channel to enable the electronic devices to make initial contact or detect each other, and then exchanging subsequent data / management frames (such as connection requests) to establish a connection, configure security options, send and receive packets or frames via the connection, etc.

[0036] like Figure 1As shown, wireless signals 116 are communicated by one or more radio components 114-1 and 114-2 in the electronic device 110-1 and the access point 112, respectively. For example, as previously mentioned, the electronic device 110-1 and the access point 112 may exchange packets or frames using the Wi-Fi communication protocol in the WLAN. In addition, the one or more radio components 114-1 may receive the wireless signals 116 transmitted by the one or more radio components 114-2 via one or more links between the electronic device 110-1 and the access point 112. Alternatively, the one or more radio components 114-1 may transmit the wireless signals 116 received by the one or more radio components 114-2.

[0037] In some implementations, the wireless signals 116 are communicated by one or more radio components 114 in the electronic device 110 and the access point 112, respectively. For example, the one or more radio components 114-1 and 114-3 can receive the wireless signals 116 sent by the one or more radio components 114-2 via one or more links between the electronic devices 110-1 and 110-2 and the access point 112.

[0038] In some implementations, the access point 112 may group the electronic devices 110 into a target site set. The concept of a target site set comes from downlink multi-user transmission, where the access point 112 may use orthogonal frequency division multiple access (OFDMA) or multi-user (MU) multiple input multiple output (MU-MIMO) to transmit to multiple sites simultaneously in one PPDU. Here, the target site set is a set of sites that can be served by the access point 112 at the same time. The stations in the set do not need to share the same PHY parameters, such as MCS, number of streams, etc.

[0039] In some implementations, the access point 112 may use multi-user (MU) technology (such as MU multiple-input multiple-output (MU-MIMO)) to communicate with multiple electronic devices 110 simultaneously. In some examples, the access point 112 communicates with the electronic devices 110 using frequency reuse, so that the access point 112 allocates a portion of the total bandwidth to each of these electronic devices. For example, in order to communicate with four electronic devices simultaneously on an 80 megahertz (MHz) bandwidth, the access point 112 sends a MU-PPDU on an 80 MHz wide bandwidth. The MU-PPDU includes a sub-PPDU for each of the four electronic devices, for example, where each sub-PPDU (or sub-channel) is allocated 20 megahertz (MHz). The access point 112 may use the MU-PPDU to communicate with devices in the same target set, devices in different target sets, or a combination of both.

[0040] In some implementations, the access point 112 and one or more electronic devices may be compatible with an IEEE 802.11 standard (e.g., IEEE 802.11ax) that includes trigger-based channel access. In 802.11ax, orthogonal frequency division multiple access (OFDMA) is used to enable simultaneous communication between the access point 112 and multiple electronic devices. OFDMA divides the available physical spectrum into multiple orthogonal subchannels or resource units (RUs) that can be allocated to different electronic devices (users). According to the standard, the access point 112 coordinates multi-user OFDMA by broadcasting a trigger frame, which also allocates RUs to each participating electronic device. Each electronic device responds to the trigger frame by sending a PPDU to the access point 112 using the allocated RU. The trigger frame may also include power control information. The access point 112 may indicate when all electronic devices 110 start and stop transmitting. It should be noted that the access point 112 and the electronic device 110 may communicate with one or more traditional electronic devices that are not compatible with the IEEE 802.11 standard (e.g., do not use multi-user triggered channel access).

[0041] In some embodiments, processing a packet or frame in one of the electronic devices 110, the access point 112, or a combination of the two includes: receiving a wireless signal 116 that encodes the packet or frame; decoding / extracting the packet or frame from the received wireless signal 116 to obtain the packet or frame; and processing the obtained packet or frame to determine information conveyed by the packet or frame (such as data in a payload).

[0042] As previously discussed, one or more electronic devices in the electronic device 110 and the access point 112 may communicate with each other. It is noteworthy that the access point 112 may send a PPDU including a preamble and a data field. In some specific implementations, the access point 112 may be configured to use a cascaded PPDU (C-PPDU), for example, for low-latency communication with a receiver station. The C-PPDU includes a plurality of component PPDUs, each of which may include a preamble and a data payload. As described in more detail below, the C-PPDU includes a plurality of component PPDUs. The first component PPDU is preceded by a first preamble called a "full preamble". The remaining component PPDUs in the C-PPDU are preceded by corresponding preambles whose lengths may be shorter than the first preamble. In some specific implementations, the access point 112 may not perform contention or receive a block acknowledgment (BA) before sending the plurality of component PPDUs.

[0043] Figure 2AAn example of an address hierarchy 700 for Wi-Fi is illustrated. The address hierarchy is used for a mobility domain where multiple APs (including multiple AP MLDs) exist. The APs of the address hierarchy 700 may support the same AKM value and may use the same PMK. Frames sent over the air have a link address in the MAC header address field.

[0044] PTK derivation uses the addresses of the station and AP in the mobility domain. The mobility domain AP scope PTK is derived by the station using the AP MAC address of the mobility domain AP, and this PTK is the same for the AP MLD in the mobility domain. During authentication and the 4-way handshake, the address of the mobility domain station is used to identify the station, and the address of the mobility domain AP is used to identify the AP. In some embodiments, a station can also have multiple MLD addresses.

[0045] The device address of the AP, station, or both in the mobility domain may be used for authentication. The address of the mobility domain AP and / or the address of the station is used for authentication in the mobility domain (e.g., for Wi-Fi 8) and for the 4-way handshake (e.g., for Wi-Fi 8). The generated PTK may be common to all APs in the mobility domain.

[0046] Figure 2B An exemplary diagram showing a process 720 of data payload (frame) encryption is illustrated. Figure 2C An exemplary diagram illustrating a process 740 for decryption of a data payload (frame) is illustrated. Additional authentication data (AAD) is used as one or more input parameters for encryption and / or decryption of a data frame. In some implementations, the AAD field of earlier standard versions (e.g., Wi-Fi 6 and earlier) uses one or more link-specific addresses. In the case of Wi-Fi 6, stations and APs each have only one address. In some implementations (e.g., Wi-Fi 7), the AAD field may use an MLD address. Using an MLD address ensures that encrypted packets can be sent on any link of the AP MLD because encryption and / or decryption is not link-specific.

[0047] Each of processes 720, 740 is configured for at least two options. In the first option, encryption and / or decryption is based on the mobility domain level address of the AP and the mobility domain level address of the site. The same encryption and / or decryption can be used for all AP MLDs of the mobility domain AP. The group number (PN) is continuous for the AP. Continuous PNs ensure that replay attacks are impossible for the network. In the second option, encryption and / or decryption is based on the site MLD address and the MLD address of the AP. The encryption can be AP MLD specific. The PN for different AP MLDs can be different in each AP. The site mobility domain address allows the site to skip the MLD layer and use a 2-level architecture or a 3-address architecture with an MLD address.

[0048] Figure 2D A flow chart showing an exemplary process 200 for establishing a communication link in a wireless network is illustrated. The network includes a station including a multi-device capability for wirelessly communicating with multiple access points. In this example, the station includes five virtual stations, numbered here as STA1, STA2, STA3, STA4, and STA5. However, in other specific implementations, the station may include any number of two or more virtual STAs. The mobility domain AP1 includes a first AP MLD Y, a second AP MLD X, and a third AP MLD Z. The first AP MLD Y includes three APs, designated as AP1, AP2, and AP3. The second AP MLD Y includes two APs, designated as AP4 and AP5. The third AP MLD Z includes two APs, designated as AP6 and AP7. However, in other specific implementations, the mobility domain AP may include any number of two or more AP MLDs, which may each include any number of two or more APs. The station is configured to connect to one or more of the APs in the process 200. The process 200 includes a discovery phase 202, an authentication phase 204, and an FT signaling phase 206.

[0049] Process 200 includes mobility domain AP-wide generation of PMK and PTK. In process 200, station STA1 is configured to establish communication links with multiple AP MLDs in a mobility domain AP by using the same association signaling to establish each link. STA MD authenticates with the mobility domain AP at the mobility domain level, which allows the same PTK to be used on all AP MLDs belonging to the same MD AP. The created PTK is synchronized with all access points in the mobility domain AP. The station generates a PTK once for all AP MLDs in the mobility domain AP. Process 200 eliminates the need to perform a four-way handshake with each AP MLD (such as AP MLD Y, AP MLD X, and AP MLD Z) of each mobility domain access point device.

[0050] A station may perform a discovery phase 202 of process 200. In the discovery phase 202, a station may transmit a probe request, where the sender address is set to one or more random addresses, and receive one or more probe responses from one or more devices that wish to establish a communication link.

[0051] The station performs an authentication phase 204, which includes the SAE request and SAE response described previously. At the FT signaling phase 206, the station is configured to perform fast BSS transition (FT) signaling. The station transmits an association request, which includes station parameters for all AP MLD links to be established. In this example, the station is connecting to AP1 through AP5 of AP MLD Y and AP MLD X. In response to a single association request including station parameters for all communication links with different AP MLDs, the station receives an association response for each access point for which a communication link is being established. The association response includes access point parameters for all AP MLD Y and AP MLD X communication links for each of AP1 through AP5.

[0052] Once process 200 is complete, the station is associated with each of AP1 to AP5. The station has generated one PTK, which is used with respect to all AP MLDs in the mobility domain. The station has created three communication links with AP MLD Y and two communication links with AP MLD X.

[0053] As previously described, the station may use one or more of the scan addresses to send to AP MLD Z. Thus, the station may use the same PTK used with respect to AP MLD Y and AP MLD X to establish one or more communication links with AP MLD Z. In this manner, the station is configured to use the existing PTK to establish communication links with one or more additional access points. The station generates a PTK once and reuses the PTK with respect to other devices in the network.

[0054] Figure 3 A flow chart showing an exemplary process 300 for authentication and association for establishing a communication link in a wireless network is illustrated. Process 300 represents different states of a station and configuration information for a mobility domain. At state 302, the station is configured to obtain network credentials, such as by scanning. The STA stores the obtained network credentials. The network credentials may include a service set identifier (SSID), an AP MLD address, an AP MLD parameter, one or more subordinate AP parameters, and / or other credentials.

[0055] At state 304, the station authenticates with the network and generates a PMK, for example, for establishing a communication link with other devices in the network. The PMK is a single PMK for the station and can be used with respect to all AP MLDs in the mobility domain AP. In some implementations, the PMK can be based on the mobility domain level media access control (MAC) addresses of the mobility domain station and the mobility domain AP.

[0056] At state 306, the station associates with one or more other AP MLDs in the network and generates PTKs for those devices in a 4-way handshake. The station may use the station's generated PTK to add one or more communication links. The station receives the over-the-air (OTA) MAC address of the associated AP MLD. The station may also obtain one or more MLD addresses associated with the non-AP MLD and / or the AP MLD Beacon Integrity Group Temporary Key (BIGTK) of the AP.

[0057] When in state 306, the station may deauthenticate from the network to return to state 302. For example, the STA or AP may transmit a frame to command a deauthentication operation. Deauthentication includes generating a deauthentication frame to be received by the station. The deauthentication frame deletes the PMK and PTK and all addresses stored at the station. In some implementations, the STA may retain the mobility domain level address and the AP MD address that it used to perform authentication, for example, so that it can authenticate with the mobility domain AP again. In conjunction with deauthentication, the network may maintain station credentials to detect the STA again in the future.

[0058] When in state 306, the station may disassociate from one or more other devices of the network. When the station disassociates from the mobility domain AP, the station deletes the PTK, all communication links, and all station link MAC addresses, MLD addresses, and scan addresses corresponding to one or more other devices of the network. To associate with a device of the network, the station transmits an association request specifying one or more STA parameters for the link, obtains an association response specifying one or more AP parameters for the link, generates additional PTKs for one or more devices of the network in a 4-way handshake, and again performs association signaling with other devices of the network.

[0059] When in state 306, the station may delete one or more communication links to disconnect from one or more specific access points or other devices of the network. To disconnect a communication link, the station may delete a link and discard the station OTA MAC address associated with the communication link. The command may include a delete link frame transmission to delete a link and discard the station OTA MAC address associated with the link.

[0060] The station uses the OTA MAC address to link to one or more APs when in state 308. The station uses the MLD address of the non-AP multilink device and the AP MLD BIGTK of the AP.

[0061] Figure 4A A flow chart showing an exemplary process 400 of checking and identifying a station from a message integrity code (MIC) is illustrated. In the process, a receiver (such as an AP) performs operations to check and identify a sender (eg, a station) from a MIC.

[0062] The process 400 includes receiving (402) a frame from a transmitter and acknowledging the frame. The process 400 includes analyzing (404) a MIC for each PTK known to the receiver. When the receiver determines that the received MIC matches a MIC value (checksum) calculated based on the PTK and the received frame, the receiver selects a current PTK and identifies the station. For example, in the event that a PTK is found, the receiver uses the PTK to decrypt (406) the received frame and transmits a response protected by the PTK. In the event that a PTK is not found, the receiver discards (408) the frame and does not identify the station.

[0063] An exemplary frame includes a preamble, a MAC header, a data payload, a MIC field, and a frame check sequence (FCS) field. The preamble, MAC header, MIC field, and FCS are clear. The data payload is encrypted. The MIC is calculated on the data payload.

[0064] The MIC calculation complexity increases linearly according to the number of sites with assigned PTKs. The AP may have hardware for calculating multiple MIC checksums in parallel, such as for triggered transmission. Sites associated with neighboring APs of the AP performing process 400 are likely to transmit PTK-protected frames to the AP. The AP may start MIC calculations from these sites. The transmitter (site) may allow the AP to respond via OTA and / or via DS, where the site communicates with the AP via the associated AP MLD. Responding via DS can reduce site power consumption and reduce operating time on the communication link. The site can receive a delayed response without relatively large power consumption. The transmitter-controlled OTA response time includes a PTK-protected probe request, followed by an acknowledgment from the receiver (e.g., AP). During the response time OTA, the transmitter (e.g., site) may receive a PTK-protected probe response. After the response time OTA, the site may receive a response via DS.

[0065] There are multiple possible communication link types in the mobility domain. The PTK receiver has an add link() function in which links such as data links, non-data links, and scan links are added. For example, the communication link type may include a scan link, which includes a link in which a station uses one or more pre-configured scan addresses to transmit protected management frames (PMFs), protected probe frames, and / or access network query protocol (ANQP) frames to an AP in the mobility domain. A station can be associated with multiple scan addresses.

[0066] The communication link type may also include a non-data link for measurement. For the non-data link, the station uses a pre-configured scan address to transmit a PMF-protected ranging request, a measurement request, and / or other data request to an access point in the mobility domain. The non-data link for measurement is used for measurement operations, not for performing data transmission.

[0067] The communication link type may also include a non-data link for signaling. For the non-data link, the station and access point may configure the STA MAC address for the non-data link. This link type may be used to send pre-association signaling.

[0068] The communication link type may also include a setup link. A setup link includes a link that is capable of data transmission but is not used to exchange data. Instead, link setup may be used by a station and an AP to exchange their capabilities and operating parameters. A station roams to a setup link. Roaming will change the setup link to a type 6 link. A station may transmit pre-association data on a setup link.

[0069] The communication link type may also include a hot standby link. A hot standby link is a special case of a setup link in which the station and access point have exchanged their capabilities and operating parameters. A hot standby link is used to prepare for station roaming within a mobility domain AP. A hot standby link is prepared for station roaming by synchronizing the buffered uplink and / or downlink data for the station currently associated with the AP MLD with the AP MLD to which the buffered link belongs.

[0070] The communication link types may also include associated AP MLD data links for uplink and / or downlink data transmission and reception. Stations in a mobility domain may be able to transmit data using one AP MLD at a time. Stations may also be able to transmit pre-associated signaling to multiple APs over multiple links. The use of these link types is described in more detail below with respect to the processes and systems for mobility domain AP-wide PTK for a mobility domain.

[0071] The station is configured for new mobility domain services. For network discovery, the station is configured to use a specific send address on the discovery frame by using signaling to add scan addresses and delete scan addresses. For network discovery, the station configures scan addresses for protected access point discovery, association, and / or for roaming within the mobility domain. The station can use configuration signaling to add a beacon integrity key or delete the beacon integrity key (BIGTK) of the AP. The station is configured with the BIGTK of the access point so the station can verify the beacon integrity based on sending the AP address and the BIGTK. The beacon integrity key can also be signaled on a PTK-protected probe response.

[0072] The station can be configured for additional services for scanning and measurement of links. The station can be configured to add non-data links or delete non-data links. For this functionality, the station creates links for security scanning, ranging and / or other measurements. For links used for scanning and / or measurement, the station and access point do not need to signal associated parameters, such as their capabilities and operating parameters. The station and access point cannot send uplink or downlink data on the links used for scanning and / or measurement.

[0073] The site may be configured for additional services for links for roaming and / or for other purposes. For example, the site may be configured to use the mobility domain AP-wide PTK for adding links, deleting links, setting an AP MLD to hot standby, and / or for roaming to an additional AP MLD. To add and / or delete links, the site and the AP may create a link that can be used for data transmission later, or the link may be set for pre-association transmission. The link setup signaling may include one or more association parameters. To set an AP MLD to hot standby mode, the site may be configured to set the AP MLD link to be ready for roaming, but the site may remain associated with the current AP MLD link. To roam to an additional AP MLD, the site sends a PTK-protected roaming request to change the site association with the additional AP MLD.

[0074] The link may use a mobility domain AP address or an AP MLD address for encryption and / or decryption. Each encrypted frame should include a unique nonce value to maintain encryption security and enable replay detection. The nonce value may include at least one of a packet number (PN) and a transmitter address that may be set to a mobility domain AP or AP MLD address. In some implementations, the packet number may be unique for each transmitted frame.

[0075] If the mobility domain AP address is used in encryption and / or decryption, the transmitter and / or receiver may maintain the state of the received packet number. The packet number should be sent continuously or semi-continuously so that each new frame sent has a larger PN value. The control of the uniqueness of the PN for data frames is simpler than for non-data and scanning links because only one AP MLD is assigned a PN at a time. Therefore, data transmissions typically use the MD address in the nonce value. Non-data links and scanning links typically do not use the MLD address in the nonce value. Data links can also use the MLD address in the nonce value, but in this case, the data transmission can be assigned a larger PN than possible non-data link or scanning link transmissions.

[0076] Figure 4B A flow chart showing an exemplary process 420 of scanning addresses to establish a communication link in a wireless network is illustrated. The associated station uses the scanning address to transmit a scanning probe request protected by a PTK and adds a link request for all AP MLDs in MD AP1 (for which the station has not established a communication link). The scanning address assists the receiving AP MLD in detecting the station and applying the correct PTK, for example, so that association and authentication can occur. The scanning address is known only to the network and the station, so the station privacy is protected from unauthorized parties.

[0077] The scan address used by the station can be a placeholder. In some specific implementations, the station can use one or more frame OTA transmitter addresses as placeholder addresses. In some specific implementations, the station uses a frame address instead of a message integrity code (MIC) tag, for example because the frame address is used by the station more quickly. To add a communication link, the data for additional access point settings is based on a scan, in which parameters for the access point are obtained. The station can accept or reject the address and ensure that each address is unique. Scans can be performed using lightweight communication links to measure parameters of other APs, and these links may not be fully configured.

[0078] The mobility domain AP identifies the station to apply the correct PTK for frame decryption. The station air MAC address identifies the station in systems that employ previous versions of the 802.11 standard. For example, the 802.11bh and / or 802.11bi groups can improve station privacy by reducing the opportunity for station tracking. In some implementations, a station can avoid using the same MAC address for multiple APs. In addition, a station can configure multiple scan addresses for one or more APs with which the station does not have an existing link.

[0079] For process 420, the station has roaming support. The PTK and scan address are set up with the network, which forwards the PTK and scan address to one or more APs to enable AP-assisted roaming. For operation 422, the station is configured to add the scan address for use in scanning to support establishing a communication link with one or more of the APs of the network. As previously described, the scan address can include many potential addresses of the network. Each address can use the station's PTK. The station transmits one or more probe requests over any link in the network.

[0080] For operation 424, the station is configured to determine a link address for establishing a communication link with the AP. The AP provides an additional address and a request to add a communication link or a non-data link. The station can identify itself by establishing an air address for each link. The air address can only be used for a dedicated link established by the station.

[0081] For operation 426, the station considers one or more of the scanned addresses as consumed addresses, for example, after they have been scanned. For example, after a link with the corresponding scanned address has been established, the station deletes the communication link or non-data link associated with the address to be considered consumed. In this case, the communication link has been established and then deleted by the station. For another example, the target AP associated with the scanned address may not be found in the network, such as for establishing a communication link with the station. In this case, the station moves to the next address in the scanning process and considers the scanned address without the target AP to be a consumed address.

[0082] Figure 5A An exemplary flow chart showing a network 600 is illustrated, the network having transmissions 602, 604 between a station and an access point for establishing a communication link in the network. In this example, the station performs a link setup with a second AP2. The setup may involve the use of protected management frames (PMF) or PMF protection. The station of the network 600 may be the same or similar to the stations described previously. The APs of the network 600 may be the same or similar to the APs described previously. The station is associated with AP1 and is establishing a link with AP2. After association, the station transmits one or more transmissions 602 to add one or more links to the associated AP MLD or other AP MLDs in the same mobility domain. The transmission 602 may set the transmitter address (TA) to the configured scanning address of the STA. The station transmits a PMF protected probe request to the second AP2. The transmission frame sets the transmitter address (TA) to the scanning address. AP2 responds to the scanning address of the transmission 602 with a PTK protected response transmission 604.

[0083] Figure 5BAn exemplary flow chart showing a network 620 is illustrated with transmissions 622, 624 between a station and an access point for establishing a communication link in the network. The network 620 includes active scanning, where a station queries one or more AP parameters to learn the BIGTK of the network. In some implementations, a station needs to know one or more AP parameters before it sets up a link.

[0084] For network 620, active scanning messages are protected by PMF, and PASN setup is not required to establish a separate PTK to encrypt active scanning messages. PASN setup for active scanning adds latency and signaling overhead to the link setup. In the PASN setup, the station is in a non-associated state. Therefore, the station will not be allowed to transmit data about the PASN setup. PASN can also be used to protect ranging (position measurement) and site sensing measurements. PASN setup is no longer required in network 600. The mobility domain AP range PTK can be used to encrypt active scanning messages instead of a separate PTK that would be established by the PASN.

[0085] The station uses the PTK to encrypt active scans. For privacy reasons, a station may not include one or more (or any) parameters in the probe requests it sends. Including parameters in the probe requests may allow an eavesdropping device to detect, for example, the type of station or activities that the station is interested in. For example, if a device manufacturer has one or more device-specific query parameters that are unique to its devices, detecting such query parameters in a probe request may reveal the station type and / or vendor.

[0086] Without the mobility domain AP-wide PTK, the station cannot verify that the probe response is valid (actually sent by the mobility domain AP). In such examples, the probe response does not include integrity protection or encryption. However, the encrypted probe response based on the mobility domain AP-wide PTK can have integrity protection so that the station can ensure that the probe response is sent by an AP belonging to the same mobility domain.

[0087] Each AP has an AP-specific BIGTK to increase the integrity protection of the beacon frames it sends. Currently, the BIGTK is only obtained in a 4-way handshake. The associated AP1 MLD can provide the BIGTK of other APs in the mobility domain (such as AP2), or can provide the BIGTK in the integrity-protected probe response. The BIGTK allows stations to receive broadcast beacon frames and verify the integrity of these frames.

[0088] In this example, the station is scanning for a second AP2, including a PTK-protected scan during setup. The station of network 620 can be the same or similar to the stations previously described. The APs of network 620 can be the same or similar to the APs previously described. The station is associated with AP1 and is establishing a link with AP2. After associating, the station transmits one or more scan addresses in transmission 622 to add one or more links to AP1 or other APs in the same mobility domain, as described in MLD with respect to FIG. Figure 5C As described. The associated AP1 MLD may signal the BIGTK in a PTK protected probe response transmission 624. The BIGTK may be sent in a Key Confirmation Key (KCK) protected transmission. The BIGTK sent 624 enables a station to verify the integrity of the beacon content before associating with AP2.

[0089] Figure 5C An exemplary flow chart showing a network 660 is illustrated, which has transmissions 662, 664 between a station and an access point for establishing a communication link in the network. In this example, the station is performing a link setup with a second AP2, wherein the setup of the link with the second AP2 uses a non-data link through an associated AP1 MLD. The station of network 660 can be the same or similar to the station described previously. The AP of network 660 can be the same or similar to the AP described previously. The station is associated with AP1 and is establishing a link with AP2. The station is configured to transmit a transmission 662 including a request to establish a non-data link with AP2 to AP1. The request specifies the identity of AP2 and the station air address. The associated AP1 MLD transmits a response transmission 664, thereby confirming that a non-data link can be established with AP2. Measurements and / or ranging can be performed on data links and / or non-data links. The station can have multiple measurements performed simultaneously or concurrently with multiple AP MLDs. In some specific implementations, the station sends uplink and / or downlink data with only one AP MLD at a time. Uplink and / or downlink data transmission is performed using a data-only link instead of a non-data link.

[0090] Figure 5D An exemplary flow chart showing a network 640 is illustrated, the network having transmissions 642, 644 between a station and an AP for establishing a communication link in the network, and is Figure 5C In this example, the station is performing a link setup with a second AP (AP2), which may include a PMF-protected scan during the setup of the link with AP2, such as Figure 5AAs shown. The site of network 640 may be the same or similar to the site described previously. The AP of network 640 may be the same or similar to the AP described previously. The site is associated with AP1 and is establishing a link with AP2. After association, the site transmits one or more scan addresses in transmission 642 to add one or more links to the associated AP MLD or other AP MLDs in the same mobility domain. In network 640, the site is configured to perform link setup with a second access point, including using PMF protection. The site is configured to initiate a scan address on transmission 642 and transmit a link request, which includes the measurement type that the link is used to carry to the add link request. The site transmits transmission 642 to the second access point AP2. AP2 transmits its response transmission 644, which includes an add link response message indicating that the measurement link is configured. Response transmission 644 confirms that the measurement link is being added. The measurement link can be used to send measurement requests and responses. In some embodiments, the add link request and response can include the first measurement request and the actual measurement response in 642 and 644, respectively.

[0091] The transmission of network 640 enables the station to generate a non-data link or "normal data" link protected by PTK. The station and AP do not need to exchange their parameters (e.g., capabilities, operating parameters, MLD parameters, etc.). These links do not have data transmission capabilities, but are used for measurement and / or ranging operations. The Add Non-Data Link Request frame may include measurement settings to be performed on the link. The Add Non-Data Link Request may request link creation to multiple AP MLDs. The link and ongoing measurements may be created simultaneously.

[0092] For networks 600, 620, 640, and 660, a station generates a PTK only once when it is associated with the first AP MLD in a mobility domain (e.g., AP1). MD AP scope PTKs reduce signaling overhead and simplify key usage. Stations only send encrypted management frames. Stations can have untraceable OTA addresses. Since no link is established without PTK protection, station privacy is well protected.

[0093] Figure 6A flow chart showing an exemplary process 500 for establishing a communication link in a wireless network is illustrated. The flow chart shows a network controller configured to scan the addresses of the AP MLDs of the network controlled by the network controller. The network controller maintains two sets of databases. The network controller has a database 512 including site information for different mobility domains. Database 512 includes PTK, PMK, site mobility domain identifiers, and site identifiers for sites operating in the network. The network controller includes a database 514 including data for all links for all AP MLDs. Database 514 includes a full set of AP parameters and site parameters for sites and APs for configured links, the AP MLD to which the site is currently associated (if any), and any PTKs and scan addresses configured. In the first group, all STA specific identifiers are stored. The database includes scan addresses, mobility domain addresses, and PTKs for sites of the network. The network controller maintains a second database containing information describing the configured links in the mobility domain, including link specific identifiers and identifiers of sites or APs of the links. The network may include an associated AP MLD that stores the associated site link specific information in the AP MLD. The network may include an MD site with all available site specific parameters. The network may include an AP MLD without a link. An AP MLD without a link with a STA may not store the information of the MD site.

[0094] A process 500 of establishing a link with AP MLD 1 without a link with an MD station is shown. At operation 502, the access point receives an action frame protected by a PTK over the air. At operation 504, the access point acknowledges the frame. At operation 506, the access point retrieves data specifying whether the transmitter address of the frame is a scan address configured by the network. The access point determines whether the frame is using a scan address by transmitting a request to a network controller (e.g., querying the network controller). As an alternative, the scan address is the send address (address 2) of the frame. However, if the send address is needed for another purpose, the scan address can be included elsewhere in the sent frame. If the scan address is in use, at operation 508, the network controller returns the PTK of the station. At operation 510, the access point decrypts the received protected action frame by using the PTK. If requested by a request frame, the access point responds to the station. The response is transmitted based on the scan address. For example, the receiver address can be set to the scan address. In addition, the response can be protected by the PTK of the STA. The response to the request to add a link and the probe request can tolerate a certain degree of delay, such as a delay between 5 milliseconds and 10 milliseconds. The network controller and the AP can complete the signaling during this time. Each AP MLD can store information corresponding to its own set link. The AP MLD can also cache the scan address and PTK of the most recently used station.

[0095] Figure 7 A flowchart of an exemplary process 800 according to some specific implementations is illustrated. For clarity of presentation, the following description generally describes process 800 in the context of other figures in this specification. For example, process 800 can be performed by Figures 1 to 6 It should be understood that process 800 can be performed by, for example, any suitable system, environment, software, hardware, or a combination of systems, environments, software, and hardware. In some specific implementations, the various operations of process 800 can be run in parallel, in combination, in a loop, or in any order.

[0096] In one aspect, process 800 includes encrypting (802), by a station in a wireless communication network, association data to add a communication link, e.g., in conjunction with associating the station with an access point (AP) to establish a wireless communication link. Data for transmission may be encrypted using a pairwise transient key (PTK). Process 800 also includes sending (804) association data for associating with the AP, the association data encrypted, e.g., using the PTK.

[0097] Figure 7 The exemplary process 800 shown may be modified or reconfigured to include additional, fewer, or different operations ( Figure 7), these operations may be performed in the order shown or in a different order. In some implementations, the station is configured to use a PTK for each of a plurality of APs in a mobility domain of the wireless communication network, the plurality of APs including the AP. In some implementations, the association data includes a scan address for the station, the scan address including a link request for one or more AP multi-link devices (MLDs) in the mobility domain with which the station does not have a link established, the one or more AP MLDs including the AP.

[0098] In some implementations, process 800 includes receiving a response transmission from the AP that is encrypted based on the PTK and indicates confirmation of the association between the AP and the station.

[0099] In some implementations, process 800 includes receiving a response transmission from the AP, the response transmission being encrypted based on the PTK and including the BIGTK for the AP.

[0100] In some implementations, the association data includes a request to establish a link and a measurement request for establishing a link with the AP, and the association data is encrypted based on a protected management frame (PMF). In some implementations, process 800 includes receiving a response transmission from the AP, the response transmission being encrypted based on the PMF, the response transmission including a measurement response for the AP.

[0101] In some implementations, the association data includes a request to establish a non-data link and a measurement request for establishing the non-data link with the AP, and the association data is transmitted to an associated AP MLD different from the AP.

[0102] In some implementations, the AP is a non-associated AP MLD of the site. In some implementations, the process 800 includes receiving from the AP an acknowledgment of receiving association data encrypted based on the PTK. In some implementations, the process 800 includes receiving from the AP a response encrypted using the PTK, the response based on receiving at the AP the PTK from the network controller.

[0103] In some implementations, the PTK is an MD AP range PTK for multiple APs in a mobility domain associated with the site. In some implementations, the association data sent by the site includes a scan address that is known to multiple APs in the mobility domain associated with the site. In some implementations, process 800 includes sending PMF-protected probe and access network query protocol (ANQP) frames from the site to the APs in the mobility domain based on the scan address. In some implementations, process 800 includes sending a ranging or measurement request from the site to the AP based on the scan address. In some implementations, process 800 includes sending capabilities and operating parameters to the AP, the sending based on roaming of the site. In some implementations, process 800 includes buffering uplink or downlink data of the associated AP MLD to synchronize with the AP. In some implementations, the wireless communication network is a Wi-Fi network.

[0104] Figure 8 A flowchart of an exemplary process 820 according to some specific implementations is illustrated. For clarity of presentation, the following description generally describes process 820 in the context of other figures in this specification. For example, process 820 can be performed by Figures 1 to 7 It should be understood that process 820 may be performed by, for example, any suitable system, environment, software, hardware, or a combination of systems, environments, software, and hardware. In some specific implementations, the various operations of process 820 may be run in parallel, in combination, in a loop, or in any order.

[0105] In one aspect, process 820 includes receiving (822) association data at an access point (AP), the association data used to associate a station with the AP to establish a wireless communication link in a wireless communication network, the data encrypted using a pairwise transient key (PTK). Process 820 includes sending (824) response data indicating establishment of the communication link to the station, the response data encrypted using the PTK.

[0106] Figure 8 The exemplary process 820 shown may be modified or reconfigured to include additional, fewer, or different operations ( Figure 8 ), these operations may be performed in the order shown or in a different order. In some implementations, the association data specifies a scan address. In some implementations, process 820 includes, in response to receiving the association data, retrieving data indicating a PTK for a transmitter address associated with the station from a network controller. In some implementations, process 820 includes decrypting the association data using the PTK. In some implementations, process 820 includes determining, based on the decryption, that the scan address specifies an address of the AP. In some implementations, process 820 includes sending response data based on the determination.

[0107] In some implementations, the association data includes a scan address for the station, the scan address including a link request for the AP. In some implementations, the PTK is an MD AP range PTK for a mobility domain associated with the station, the mobility domain including the AP. In some implementations, the response data is encrypted based on the PTK and includes a BIGTK for the AP. In some implementations, the response data includes a measurement response for the AP. In some implementations, process 820 includes receiving a ranging or measurement request from the station. In some implementations, process 820 includes sending ranging or measurement data encrypted with the PTK based on the request. In some implementations, process 820 includes buffering uplink or downlink data to synchronize with the station. In some implementations, the wireless communication network is a Wi-Fi network.

[0108] Fig. 9 A block diagram of an electronic device 900 according to some implementations is illustrated. The electronic device 900 may be a cellular phone, a smart watch, an access point, a wireless speaker, an Internet of Things (IoT) device, etc. The electronic device 900 includes hardware resources 902, which include one or more processors (or processor cores) 910, one or more memory / storage devices 920, and one or more communication resources 930, each of which may be communicatively coupled via a bus 940.

[0109] The one or more processors 910 include one or more devices configured to perform computing operations. For example, the one or more processors 910 may include one or more microprocessors, application specific integrated circuits (ASICs), microcontrollers, graphics processing units (GPUs), programmable logic devices, and / or one or more digital signal processors (DSPs). The processor 910 may include, for example, a processor 912 and a processor 914. The processor 910 may be, for example, a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a DSP such as a baseband processor, an ASIC, an FPGA, a radio frequency integrated circuit (RFIC), another processor (including those discussed herein), or any suitable combination thereof.

[0110] The memory / storage device 920 may include a main memory, a disk storage device, or any suitable combination thereof. The memory / storage device 920 may include, but is not limited to, any type of volatile or non-volatile memory, such as a dynamic random access memory (DRAM), a static random access memory (SRAM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a solid-state storage device, and the like. In some specific implementations, the memory / storage device 920 is coupled to one or more high-capacity mass storage devices (not shown). In some examples, the memory / storage device 920 may be coupled to a disk drive or an optical drive, a solid-state drive, or another type of mass storage device. In these examples, the memory / storage device 920 may be used by the electronic device 900 as a fast access storage device for frequently used data, while the mass storage device is used to store less frequently used data.

[0111] The communication resources 930 may include an interconnect or network interface component or other suitable device to communicate with one or more peripheral devices 904 or one or more databases 906 via the network 908. For example, the communication resources 930 may include a wired communication component (e.g., for coupling via USB), a cellular communication component, an NFC component, (or Low power consumption) components, components and other communication components.

[0112] The communication resources 930 include one or more devices configured to couple to and communicate on a wired and / or wireless network (i.e., perform network operations), such as: a control logic component, one or more interface circuits, and a group of antennas (or antenna elements) in an adaptive array that can be selectively turned on and / or off by the control logic component to produce a variety of optional antenna patterns or "beam patterns." Alternatively, instead of the group of antennas, in some examples, the electronic device 900 includes one or more nodes, such as pads or connectors, which can be coupled to the group of antennas. Thus, the electronic device 900 may or may not include the group of antennas. For example, the communication resources 930 may include a Bluetooth TM networking systems, cellular networking systems (e.g., 3G / 4G / 5G / 6G networks such as UMTS, LTE, etc.), universal serial bus (USB) networking systems, networking systems based on standards described in IEEE 802.11 (such as networking system), an Ethernet networking system, and / or another networking system.

[0113] In some implementations, the communication resources 930 include one or more radio components, such as a wake-up radio component for receiving wake-up frames and wake-up beacons, and a main radio component for sending and / or receiving frames or packets during normal operating mode. The wake-up radio component and the main radio component can be implemented separately (such as using discrete components or separate integrated circuits) or can be implemented in a common integrated circuit.

[0114] The communication resources 930 include processors, controllers, radios / antennas, sockets / plugs, and / or other devices for coupling to, communicating on, and processing data and events for each supported networked system. Note that the mechanisms for coupling to, communicating on, and processing data and events on the networks of network systems are sometimes collectively referred to as the "network interfaces" of the network systems.

[0115] The instructions 950 may include software, programs, applications, applet, applications, or other executable code for causing at least any one of the processors 910 to perform any one or more of the methods discussed herein. The instructions 950 may reside completely or partially in at least one of the processors 910 (e.g., in a cache memory of the processor), the memory / storage device 920, or any suitable combination thereof. In some implementations, any portion of the instructions 950 may be transmitted to the hardware resources 902 from any combination of the peripheral device 904 or the database 906. Thus, the memory of the processor 910, the memory / storage device 920, the peripheral device 904, and the database 906 are examples of computer-readable media and machine-readable media.

[0116] Although the foregoing discussion uses the Wi-Fi communication protocol as an illustrative example, in other specific implementations, a variety of communication protocols may be used, and more generally, wireless communication technologies may be used. Therefore, the communication technology may be used in a variety of network interfaces. In addition, although some of the operations in the foregoing specific implementations are implemented in hardware or software, in general, the operations in the foregoing specific implementations may be implemented in a variety of configurations and architectures. Thus, some or all of the operations in the foregoing specific implementations may be performed in hardware, in software, or in a combination of both hardware and software. For example, at least some of the operations in the communication technology may be implemented using instructions 950, an operating system (such as a driver for an interface circuit in a communication resource 930), or in firmware in an interface circuit in a communication resource 930. Additionally or alternatively, at least some of the operations in the communication technology may be implemented in a physical layer (such as hardware in an interface circuit in a communication resource 930). In some specific implementations, the communication technology is implemented at least partially in a MAC layer and / or a physical layer in an interface circuit in a communication resource 930.

[0117] Although the foregoing embodiments illustrate the use of wireless signals in one or more frequency bands, in some implementations, electromagnetic signals in one or more different frequency bands are used to determine distance. For example, these signals may be communicated in one or more frequency bands, including: microwave bands, radar bands, 900 MHz, 2.4 GHz, 5 GHz, 6 GHz, 60 GHz, and / or frequency bands used by Citizens Broadband Radio Service, LTE, 5G, or any other communication system.

[0118] Although the electronic device 900 is described using specific components, in some implementations, different components and / or subsystems may be present in the electronic device 900. For example, the electronic device 900 may include one or more additional processing subsystems, memory subsystems, networking subsystems, and / or display subsystems. Additionally, one or more of the subsystems may not be present in the electronic device 900. In some implementations, the electronic device 900 may include Fig. 9 In some implementations, the electronic device 900 may include an analysis subsystem that performs at least some of the operations in the communication technology. Fig. 9 , but in some implementations, some or all of a given subsystem or component may be integrated into one or more of the other subsystems or components in the electronic device 900.

[0119] For one or more embodiments, at least one of the components shown in one or more of the foregoing figures may be configured to perform one or more operations, techniques, processes, or methods described in the following example section. For example, the baseband circuit described above in conjunction with one or more of the foregoing figures may be configured to operate according to one or more of the examples described below. For another example, the circuits associated with the UE, base station, network element, etc. described above in conjunction with one or more of the foregoing figures may be configured to operate according to one or more of the examples shown in the example section below.

[0120] Example

[0121] In the following sections, additional exemplary embodiments are provided.

[0122] Embodiment 1 includes: encrypting, by a station in a mobility domain of a wireless communication network, association data, wherein the encryption is performed using a pairwise transient key (PTK); and sending the encrypted association data to an AP to establish a wireless communication link.

[0123] Embodiment 2 includes the features of embodiment 1, wherein the station uses the PTK to encrypt data for transmission to a second AP of the mobility domain.

[0124] Embodiment 3 includes the features of any one of embodiments 1 to 2, wherein the association data includes one or more scan addresses associated with the station, the one or more scan addresses including a link request for an AP multi-link device (MLD) in the mobility domain with which the station does not have a link established.

[0125] Embodiment 4 includes the features of any one of embodiments 1 to 3, further comprising: receiving a response from the AP, wherein the response is encrypted based on the PTK and indicates confirmation of the association between the AP and the station.

[0126] Embodiment 5 includes the features of any one of embodiments 1 to 4, further comprising: receiving a response from the AP, wherein the response is encrypted based on the PTK and includes a beacon integrity key (BIGTK).

[0127] Embodiment 6 includes the features of any one of embodiments 1 to 5, wherein the association data includes a request to establish a link with the AP and a measurement request, and the association data is encrypted based on at least one protected management frame (PMF).

[0128] Embodiment 7 includes the features of any one of embodiments 1 to 6, further comprising: receiving a measurement response from the AP, wherein the measurement response is encrypted based on the PMF.

[0129] Embodiment 8 includes the features of any one of embodiments 1 to 7, wherein the association data includes a request to establish a non-data link and a measurement request for establishing the non-data link with the AP, and the association data is transmitted to an associated AP MLD different from the AP.

[0130] Embodiment 9 includes the features of any one of embodiments 1 to 8, wherein the station is not associated with an AP, the method further comprising: receiving a confirmation from the AP confirming receipt of the encrypted association data; and receiving a response from the AP encrypted using the PTK.

[0131] Embodiment 10 includes the features of any one of embodiments 1 to 9, wherein the PTK is an MD AP-scoped PTK for multiple APs in the mobility domain.

[0132] Embodiment 11 includes the features of any one of embodiments 1 to 10, wherein the association data includes one or more scan addresses known to a plurality of APs in the mobility domain.

[0133] Embodiment 12 includes the features described in any one of embodiments 1 to 11, and further includes: sending one or more PMF-protected probe or access network query protocol (ANQP) frames to the AP based on the one or more scan addresses.

[0134] Embodiment 13 includes the features of any one of embodiments 1 to 12, further comprising: sending a ranging or measurement request to an AP based on the one or more scanning addresses.

[0135] Embodiment 14 includes the features of any one of embodiments 1 to 13, and further includes: sending one or more capabilities or operating parameters to the AP.

[0136] Embodiment 15 includes the features of any one of embodiments 1 to 14, further comprising: buffering uplink or downlink data of an associated AP MLD to synchronize with the AP.

[0137] Embodiment 16 includes the features of any one of embodiments 1 to 15, wherein the wireless communication network is a Wi-Fi network.

[0138] Embodiment 17 includes: receiving association data at an access point (AP), the association data being used to associate a station with the AP to establish a wireless communication link in a wireless communication network, the data being encrypted using a pairwise transient key (PTK); and sending response data indicating the establishment of the communication link to the station, the response data being encrypted using the PTK.

[0139] Embodiment 18 includes features according to embodiment 17, wherein the association data specifies a scanning address, and the method further includes: in response to receiving the association data, retrieving data indicating a PTK for a transmitter address associated with the site from a network controller; using the PTK to decrypt the association data; determining based on the decryption that the scanning address specifies the address of the AP; and sending response data based on the determination.

[0140] Embodiment 19 includes the features of any one of embodiments 17 to 18, wherein the association data includes a scan address for the station, the scan address including a link request for the AP.

[0141] Embodiment 20 includes the features of any one of embodiments 17 to 19, wherein the PTK is an MD AP-scoped PTK for a mobility domain associated with the station, the mobility domain including the AP.

[0142] Embodiment 21 includes the features of any one of embodiments 17 to 19, wherein the response data is encrypted based on the PTK and includes a Beacon Integrity Key for the AP (BIGTK).

[0143] Embodiment 22 includes the features of any one of embodiments 17 to 19, wherein the response data includes a measurement response for the AP.

[0144] Embodiment 23 includes the features of any one of embodiments 17 to 19, further comprising: receiving a ranging or measurement request from a station; and sending ranging or measurement data encrypted with a PTK based on the request.

[0145] Embodiment 24 includes the features of any one of embodiments 17 to 19, further comprising: buffering uplink or downlink data to synchronize with the site.

[0146] Embodiment 25 includes the features of any one of embodiments 17 to 19, wherein the wireless communication network is a Wi-Fi network.

[0147] Embodiment 26 may include one or more non-transitory computer-readable media, which include instructions that, when executed by one or more processors of an electronic device, cause the electronic device to perform one or more elements of a method described or related to any one of Embodiments 1 to 25 or any other method or process described herein.

[0148] Embodiment 27 may include an apparatus comprising logic, modules, or circuits for performing one or more elements of a method as described or related to any of Embodiments 1 to 25, or any other method or process described herein.

[0149] Embodiment 28 may include methods, techniques or processes described or related to any one of Embodiments 1 to 25, or parts or components thereof.

[0150] Embodiment 29 may include a device comprising: one or more processors and one or more computer-readable media, wherein the one or more computer-readable media include instructions that, when executed by the one or more processors, cause the one or more processors to perform a method, technique, process, or portion thereof described in or related to any one of Embodiments 1 to 25.

[0151] Embodiment 30 may include a signal as described or related to any one of Embodiments 1 to 25, or a portion or component thereof.

[0152] Embodiment 31 may include a datagram, information element, packet, frame, segment, PDU or message, or a portion or part thereof, as described or related to any one of Embodiments 1 to 25, or otherwise described in the present disclosure.

[0153] Embodiment 32 may include a signal encoded with data as described or associated with any one of Embodiments 1 to 25, or a portion or component thereof, or otherwise described in this disclosure.

[0154] Embodiment 33 may include a signal encoded with a datagram, IE, packet, frame, segment, PDU or message as described or associated with any one of Embodiments 1 to 25, or a portion or part thereof, or otherwise described in the present disclosure.

[0155] Embodiment 34 may include an electromagnetic signal carrying computer-readable instructions, wherein execution of the computer-readable instructions by one or more processors will cause the one or more processors to perform a method, technique, or process, or portion thereof, as described or related to any one of Embodiments 1 to 25.

[0156] Embodiment 35 may include a computer program including instructions, wherein execution of the program by a processing element causes the processing element to perform a method, technique, or process, or a portion thereof, as described or related to any one of embodiments 1 to 25. The operations or actions performed by the instructions executed by the processing element may include a method according to any one of embodiments 1 to 25.

[0157] Embodiment 36 may include signals in a wireless network as shown and described herein.

[0158] Embodiment 37 may include a method of communicating in a wireless network as shown and described herein.

[0159] Embodiment 38 may include a system for providing wireless communication as shown and described herein. The operations or actions performed by the system may include a method according to any one of Embodiments 1 to 25.

[0160] Embodiment 39 may include an apparatus for providing wireless communication as shown and described herein. The operations or actions performed by the apparatus may include a method according to any one of Embodiments 1 to 25.

[0161] Previously described embodiments 1 to 25 can be implemented using a computer-implemented method; a non-transitory computer-readable medium storing computer-readable instructions to execute the computer-implemented method; and a computer system comprising a computer memory interoperably coupled to a hardware processor configured to execute the computer-implemented method or instructions stored on the non-transitory computer-readable medium.

[0162] A system may be configured to perform the actions by having software, firmware, hardware, or a combination thereof installed on the system that causes the system to perform specific operations or actions in operation. One or more computer programs may be configured to perform the actions by including instructions that, when executed by a data processing device, cause the device to perform specific operations or actions. The operations or actions performed by the system or the instructions executed by the data processing device may include the method of any one of embodiments 1 to 25.

[0163] Unless explicitly stated otherwise, any of the above embodiments may be combined with any other embodiment (or combination of embodiments). The foregoing description of one or more specific implementations provides illustration and description, but is not intended to be exhaustive or to limit the scope of the embodiments to the precise form disclosed. Modifications and variations are possible in view of the above teachings or may be obtained from the practice of the various embodiments.

[0164] Although the above embodiments have been described in considerable detail, numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to include all such variations and modifications.

[0165] It is understood that the use of personally identifiable information should be subject to privacy policies and practices that are generally recognized to meet or exceed industry or government requirements for maintaining user privacy. Specifically, personally identifiable information data should be managed and processed to minimize the risk of unintentional or unauthorized access or use, and the nature of the authorized use should be clearly stated to users.

Claims

1. One or more processors configured to cause the site to perform operations including: encrypting association data corresponding to the station in a mobility domain of a wireless communication network, wherein the encryption is performed using a pairwise transient key (PTK); and A transmission including the encrypted association data is generated to the AP to establish a wireless communication link.

2. The one or more processors of claim 1, wherein the station uses the PTK to encrypt data for transmission to a second AP of the mobility domain.

3. The one or more processors of claim 1, the operations further comprising: Identify an AP multi-link device (MLD) in a mobility domain AP, wherein the station does not establish a link with the AP MLD; including in the association data one or more scan addresses associated with the site, the one or more scan addresses identifying the site; and A link request is generated for sending to the AP MLD.

4. The one or more processors of claim 1 , further comprising: A response is received from the AP, wherein the response is encrypted based on the PTK and indicates confirmation of the link creation between the AP and the station.

5. The one or more processors of claim 1 , further comprising: A response is received from the AP, wherein the response is encrypted based on the PTK and includes a link-specific beacon integrity key (BIGTK).

6. The one or more processors of claim 1, wherein the association data comprises a request to establish a link with the AP and a measurement request, the association data being encrypted based on at least one protected management frame (PMF).

7. The one or more processors of claim 6, further comprising: A measurement response is received from the AP, the measurement response being encrypted based on the PMF.

8. The one or more processors of claim 1, wherein the association data comprises a request to establish a non-data link and a measurement request for establishing the non-data link with the AP, the association data being transmitted to an associated AP MLD different from the AP.

9. The one or more processors of claim 1, wherein the station is not associated with the AP, the operations further comprising: receiving an acknowledgement from the AP, the acknowledgement acknowledging receipt of the encrypted association data; as well as A response is received from the AP encrypted using the PTK.

10. The one or more processors of claim 1, wherein the PTK is a mobility domain access point-wide PTK associated with a plurality of APs in the mobility domain APs.

11. The one or more processors of claim 1, wherein the association data comprises one or more scan addresses known to a plurality of APs in the mobility domain.

12. The one or more processors of claim 11, further comprising: One or more PMF protected probe or Access Network Query Protocol (ANQP) frames are sent to the AP based on the one or more scanning addresses.

13. The one or more processors of claim 1, the operations further comprising: One or more capabilities or operating parameters are sent to the AP.

14. The one or more processors of claim 1, the operations further comprising: Uplink or downlink data of an associated AP MLD is buffered to synchronize with the AP MLD.

15. A method for wireless communication, comprising: receiving association data at an access point (AP), the association data being used to associate a station with the AP to establish a wireless communication link in a wireless communication network, the data being encrypted using a pairwise transient key (PTK); as well as A transmission is generated to the station, with response data indicating that the communication link is established, the response data being encrypted using the PTK.

16. The method of claim 15, wherein the association data specifies a scan address, the method further comprising: in response to receiving the association data, retrieving data from a network controller indicating that the PTK is for an address associated with the station; decrypting the associated data using the PTK; determining, based on the decrypting, that the address associated with the station is an address of the AP; as well as The response data is prepared to be sent based on the determination.

17. The method of claim 15, wherein the association data comprises a scan address for the station and a link request for the AP.

18. The method of claim 15, wherein the PTK is a mobility domain access point scope PTK for a mobility domain associated with the station, the mobility domain including the AP.

19. A method comprising: encrypting association data corresponding to a station in a mobility domain of a wireless communication network, wherein the encryption is performed using a pairwise transient key (PTK); as well as A transmission including the encrypted association data is generated to the AP to establish a wireless communication link.

20. The method of claim 19, wherein the station uses the PTK to encrypt data for transmission to a second AP of the mobility domain.

Images