Wireless communication method, wireless communication device, medium and program product

Abstract

The embodiment of the invention provides a wireless communication method, wireless communication equipment, a computer readable storage medium and a computer program product. According to the wireless communication method, an extended message integrity check (MIC) field is generated for a frame header field which is not protected by additional authentication data (AAD), and an MPDU frame is inserted, so that the reliability of a frame header is improved, and meanwhile, when MPDU retransmission is carried out, only the extended MIC field is calculated and updated, and the communication efficiency is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular, to a wireless communication method, a wireless communication device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the development of mobile Internet, more and more communication devices or terminals need to communicate wirelessly. IEEE802.11 is a standard for wireless network communication defined by the Institute of Electrical and Electronics Engineers (IEEE). Among them, the IEEE 802.11 Robust Security Network Association (RSNA) standard defines the encryption process of the Medium Access Control Protocol Data Unit (MPDU).

[0003] In the related art, the integrity protection of the Media Access Control (MAC) frame header is achieved by constructing Additional Authentication Data (AAD), but since the masked field in the MAC frame header is easily attacked, the reliability of MPDU retransmission is reduced. Therefore, how to improve the reliability of the MAC frame header and reduce the possibility of being attacked is an issue that needs to be discussed and solved urgently. Summary of the invention

[0004] The embodiments of the present application provide a wireless communication method, a wireless communication device, a computer-readable storage medium, and a computer program product, aiming to achieve a wireless communication method with higher reliability and related communication devices.

[0005] In a first aspect, an embodiment of the present application provides a method for wireless communication, including: a first media access control protocol data unit MPDU frame includes a first frame header field and a frame body field; based on the first frame header field, an extended message integrity code MIC field is obtained; the plaintext data in the frame body field is encrypted and calculated to obtain a ciphertext data field; based on a PN value and a first key, an encryption calculation header field is obtained; based on the first frame header field, the encryption calculation header field, the ciphertext data field, and the extended message integrity code MIC field, a second media access control protocol data unit MPDU frame is obtained, wherein the second media access control protocol data unit MPDU frame is an encrypted media access control protocol data unit MPDU frame.

[0006] In a second aspect, an embodiment of the present application provides a method for wireless communication, including: a first media access control protocol data unit MPDU frame includes a first frame header field and a frame body field; based on the first frame header field, an extended message integrity code MIC field is obtained; the plaintext data in the frame body field is verified and calculated to obtain a first management message integrity code element MME field; based on the first frame header field, the first management message integrity code element MME field, and the extended message integrity code MIC field, a second media access control protocol data unit MPDU frame is obtained.

[0007] In a third aspect, an embodiment of the present application provides a wireless communication device, comprising: at least one processor; at least one memory for storing at least one program; and when at least one of the programs is executed by at least one of the processors, a method as described in any one of the first aspect or the second aspect is implemented.

[0008] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions for executing the method described in any one of the first aspect or the second aspect.

[0009] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program or computer instructions, wherein the computer program or the computer instructions are stored in a computer-readable storage medium, a processor of a computer device reads the computer program or the computer instructions from the computer-readable storage medium, and the processor executes the computer program or the computer instructions, so that the computer device performs the method as described in any one of the first aspect or the second aspect.

[0010] According to the wireless communication method, wireless communication device, computer-readable storage medium and computer program product provided by the embodiments of the present application, the wireless communication method improves the reliability of the frame header by generating an extended message integrity check code (MIC) field for the frame header field not protected by AAD and inserting it into the MPDU when performing MPDU encryption or integrity protection. At the same time, when retransmitting the MPDU, only the extended MIC field can be calculated and updated, thereby improving communication efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a schematic diagram of the structure of a CCMP protected MPDU frame;

[0012] Figure 2 It is a schematic diagram of the structure of a GCMP protected MPDU frame;

[0013] Figure 3It is a schematic diagram of the structure of a BIP-protected MPDU management frame;

[0014] Figure 4 It is a schematic diagram of the process of pairwise key generation;

[0015] Figure 5 It is a schematic diagram of the process of generating a master key;

[0016] Figure 6 It is a flow chart of a 4-way handshake;

[0017] Figure 7 It is a schematic diagram of the structure of a RSNE field;

[0018] Figure 8 is the cipher suite definition diagram;

[0019] Fig. 9 It is the RSNXE field definition diagram;

[0020] Fig.10 It is a flow chart of AAD construction using CCMP as an example;

[0021] Fig.11 It is a flowchart of MPDU encryption taking CCMP as an example;

[0022] Fig.12 It is a schematic diagram of the structure of a masked field of a frame header of an MPDU frame;

[0023] Fig.13 This is the HTC extended function map;

[0024] Fig.14 is a flowchart of a wireless communication method provided by an embodiment of the present application;

[0025] Fig.15 It is a schematic diagram of the structure of the field to be checked provided in an embodiment of the present application;

[0026] Fig.16 This is a structural diagram of adding a protection indication mark in the RSNXE field provided in an embodiment of the present application;

[0027] Fig.17 is a flowchart of a wireless communication method provided by an embodiment of the present application;

[0028] Fig.18 is a schematic diagram of the structure of a field to be checked provided by another embodiment of the present application;

[0029] FIG. 19( a ) is a schematic diagram of the structure of a management message integrity code element MME field provided in an embodiment of the present application;

[0030] FIG. 19( b ) is a schematic diagram of the structure of a management message integrity code element MME field provided in another embodiment of the present application;

[0031] FIG. 20( a ) is a negotiation flow chart of detecting associations between network nodes provided in an embodiment of the present application;

[0032] FIG. 20( b ) is a negotiation flow chart of detecting associations between network nodes provided in another embodiment of the present application;

[0033] Fig.21 is a schematic diagram of an extended MIC calculation provided by an embodiment of the present application;

[0034] Fig. 22 is a schematic diagram of an extended MIC calculation provided by another embodiment of the present application;

[0035] Fig.23 is a schematic diagram of an extended MIC calculation provided by another embodiment of the present application;

[0036] Fig.24 is a schematic diagram of an extended MIC calculation provided by another embodiment of the present application;

[0037] Fig.25 is a schematic diagram of the structure of an extended CCMP frame provided in an embodiment of the present application;

[0038] Fig.26 is a schematic diagram of the structure of an extended GCMP frame provided in an embodiment of the present application;

[0039] Fig. 27 is a schematic diagram of an extended MIC calculation provided by another embodiment of the present application;

[0040] Fig.28 is a schematic diagram of an extended MIC calculation provided by another embodiment of the present application;

[0041] Fig.29 is a schematic diagram of the structure of an extended CCMP frame provided by another embodiment of the present application;

[0042] Fig.30 is a schematic diagram of the structure of an extended GCMP frame provided in another embodiment of the present application;

[0043] Fig.31 This is a schematic diagram of a network node structure provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0046] In the embodiments of the present application, the words "further", "exemplarily" or "optionally" are used to indicate examples, illustrations or descriptions, and should not be interpreted as being more preferred or more advantageous than other embodiments or designs. The use of the words "further", "exemplarily" or "optionally" is intended to present related concepts in a specific way.

[0047] The IEEE 802.11 Baseline defines the Robust Security Network Association (RSNA) standard, which is used for key generation, distribution, encryption and decryption, etc., to protect wireless network security. The standard divides security algorithms into two categories: Pre-Robust Security Network Association (Pre-RSNA) security algorithm and RSNA security algorithm. Among them, Pre-RSNA algorithms include Wired Equivalent Privacy (WEP), Open System Authentication (Open System Authentication) and Shared Key Authentication (Shared Key Authentication); RSNA algorithms include Temporal Key Integrity Protocol (TKIP), Counter Mode with Cypher Block Chaining Message Authentication Code Protocol (CCMP), Galois Counter Mode Protocol (GCMP), Broadcast / multicast Integrity Protocol (Broadcast / multicast Integrity Protocol, BIP), RSNA establishment and termination process, key management process, etc.

[0048] In the related art, CCMP is used to provide data confidentiality, authentication, data integrity and replay protection. CCMP is based on the encryption algorithm CCM of the Advanced Encryption Standard (AES) to protect the integrity of the selected part of the IEEE802.11 MPDU frame header and the MPDU data field. The CCM encryption algorithm generates the ciphertext and the message integrity check value MIC. The receiver decrypts the frame body and compares the received MIC with the calculated MIC to perform a MIC check. Among them, the MPDU frame format protected by CCMP is as follows: Figure 1 As shown, it includes a MAC frame header field, a CCMP header field (8 8-bit bytes), Data (protocol data unit PDU, at least one 8-bit octet), a message integrity code MIC field and an FCS frame check sequence field (4 8-bit bytes), wherein the Data and message integrity code MIC fields are encrypted, and the message integrity code MIC field is variable. CCMP-128 processing will expand the original MPDU size by 16 bytes, of which 8 bytes are used for the CCMP header field and 8 bytes are used for the MIC field; CCMP-256 processing will expand the original MPDU size by 24 bytes, of which 8 bytes are used for the CCMP header field and 16 bytes are used for the MIC field.

[0049] GCMP is used to provide data confidentiality, authentication, data integrity, and replay protection. GCMP is based on the AES encryption algorithm GCM, which protects the integrity of the MPDU data field and selected parts of the MPDU frame header. The GCM encryption algorithm generates ciphertext and message integrity check value MIC. The receiver decrypts the frame body and compares the received MIC with the calculated MIC to perform a MIC check. Among them, the MPDU frame format protected by GCMP is as follows Figure 2 As shown, it includes MAC frame header field, GCMP header field (8 8-bit bytes), Data data (protocol data unit PDU, at least one 8-bit octet), message integrity code MIC field (16 8-bit bytes) and FCS frame check sequence field (4 8-bit bytes), where the Data data is encrypted. GCMP processing will expand the original MPDU size by 24 bytes, of which 8 bytes are used for the GCMP header field and 16 bytes are used for the MIC field.

[0050] BIP is used for data integrity and replay protection of multicast robust management frames and beacon frames. The MPDU frame format protected by BIP is as follows: Figure 3As shown, it includes an IEEE 802.11 frame header field, a management frame body field including a management message integrity code element MME (Management Frame Body including MME), and an FCS frame check sequence field.

[0051] The IEEE 802.11RSNA standard also defines a protocol using the key information frame protocol data unit (EAPOL-keyPDU), called the 4-way handshake, which is mainly used to complete key negotiation and generate pairwise transient keys (PTK), group temporary keys (GTK), integrity group temporary keys (IGTK) and beacon integrity group temporary keys (BIGTK).

[0052] Among them, PTK is generated through a 4-way handshake based on the pairwise master key (PMK) and is used to protect unicast streams. Figure 4 The figure shows the generation process of pairwise keys, and generates pairwise temporary keys PTK according to pairwise master keys PMK. The specific calculation formula is PRF-Length (PMK, "Pairwise key expansion", Min (AA, SPA) || Max (AA, SPA) || Min (ANonce, SNonce) || Max (ANonce, SNonce)), where the pairwise temporary key PTK includes the key information frame confirmation key (EAPOL-Key Confirmation Key, KCK), the key information frame encryption key (EAPOL-Key Encryption Key, KEK) and the temporary key (Temporal Key, TK); GTK is generated by a 4-way handshake based on the group master key (Group Master Key, GMK) and is used to protect multicast streams. Figure 5 The figure shows the process of generating the group key. The group temporary key GTK is generated according to the group master key GMK. The specific calculation formula is PRF-Length (GMK, "Group key expansion", AA||GNonce); IGTK is generated through a 4-way handshake and is used to protect the integrity of the multicast robust management frame (Robust ManagementFrame); BIGTK is also issued through a 4-way handshake and is used to protect the integrity of the beacon frame.

[0053] like Figure 6As shown, the 4-way handshake includes the following steps:

[0054] a) The authenticator sends an EAPOL-Key containing ANonce, which is a random number generated by the access point (AP).

[0055] b) The requester derives the PTK from ANonce and SNonce, where SNonce is a random number generated by the workstation.

[0056] c) The supplicant sends an EAPOL-Key containing the SNonce, the Robust Security Network Element (RSNE) from the (Re)Association Request frame, and the MIC.

[0057] d) The authenticator derives the PTK from ANonce and SNonce and verifies the MIC in the EAPOL-Key.

[0058] e) The Authenticator sends an EAPOL-Key containing ANonce, RSNE, MIC, GTK, IGTK, and BIGTK from its beacon or probe response frame.

[0059] f) The supplicant sends EAPOL-Key to confirm whether the temporary key is installed.

[0060] The RSNE field in the above steps contains the information required to establish RSNA and is used by AP and STA to negotiate RSNA capabilities. Figure 7 The RSNE field structure includes multiple encryption suites, wherein the Group Data CipherSuite field and the Pairwise Cipher Suite field are used to negotiate group encryption and pairwise encryption suites. Figure 8 The cipher suite definition information is shown.

[0061] The Robust Security Network extension element (RSNXE) field is an extension element of the Robust Security Network (RSN) and contains additional information for establishing RSNA. Fig. 9 The specific definition information of the RSNXE field is shown.

[0062] The key generated based on the 4-way handshake is used for encryption and integrity verification of the MPDU frame. The IEEE 802.11 standard only encrypts the payload of the MPDU frame body, and the frame header is not encrypted to ensure that it is visible to all receivers. Among them, the payload of the management frame protected by BIP is not encrypted. In order to ensure that the integrity of the frame header has not been illegally modified, AAD will be constructed during the encryption process. As an input to the encryption module, AAD will contain part of the field of the frame header, and then the MIC will be calculated together with the plaintext data. The receiving end relies on MIC to verify the integrity of the entire frame to determine whether it has been illegally modified. Fig.10 The construction process of AAD using CCMP as an example is shown. AAD is constructed based on the frame header of the plaintext MPDU (Construct AAD), which is used as the input of the CCM encryption module (CCM encryption). Combined with other inputs, the ciphertext Data and encrypted MIC fields are obtained.

[0063] The MPDU encryption process defined in the IEEE 802.11RSNA standard has a total of 4 inputs, including the constructed AAD, a random number (Number Once, Nonce) used only once, plaintext data Data, and a temporary key (Temporal Key, TK). The encryption module has two outputs, namely ciphertext Data and MIC. Fig.11 The encryption process of the MPDU frame using CCMP as an example is shown. AAD is created based on the frame header, and a random number Nonce is created based on the plaintext data of the frame body and the packet sequence number PN.

[0064] Since the values ​​of some fields of an MPDU may change when it is retransmitted, Baseline masks the fields that may change in order to avoid re-encrypting the MPDU when it is retransmitted. Fig.12 The masked fields of the MPDU frame header are shown. These masked fields are not included in the AAD and therefore cannot be integrity protected and are vulnerable to attacks.

[0065] For example, possible attack scenarios include:

[0066] (1) Targeting the unprotected power-saving bit PM in the frame header, an attacker can send a spoofed power-saving frame (used to indicate that the client is entering sleep mode) and then send an authentication or association frame to reset the wireless connection. Subsequently, through a wake-up frame, the access point will restore the buffered data in an undefined context, causing data frame leakage;

[0067] (2) For the unprotected SN field, the attacker can use the replayed frame with modified SN to attack, causing confusion in the receiver's scoreboard and reordering buffer context. This attack cannot be protected by PN check;

[0068] (3) For the unprotected HT-Control field, an attacker can use a variety of means to attack the receiver. Fig.13 The extended functions of HT-Control in 802.11ax and 802.11be are shown. For example, by forging TRS, the receiver can keep sending TB PPDU, wasting air interface and consuming power continuously; by forging OM indication, the receiver can keep working in low bandwidth and low spatial flow state; by forging BSR, the receiver can obtain wrong data cache state, resulting in workstation unable to be scheduled normally, and so on. As the HTC field is extended with more functions, it is easier to be attacked.

[0069] In July 2022, IEEE established the Ultra High Reliability (UHR) study group (SG), whose mission is to study the evolution direction of the next-generation (Wireless Fidelity-8, Wi-Fi 8) technology, and plans to establish the 802.11bn working group in November 2023 and draft the Wi-Fi 8 protocol definition. UHR is committed to improving reliability, reducing latency and reducing device power consumption.

[0070] Based on this, the present application provides a wireless communication method, a wireless communication device, a computer-readable storage medium, and a computer program product. The wireless communication method provided in one embodiment of the present application generates an extended MIC for a frame header field that is not protected by AAD and inserts it into the MPDU, thereby improving the reliability of the UHR frame header. The wireless communication method provided in another embodiment of the present application no longer constructs AAD, generates an extended MIC for the entire frame header or the entire frame, and inserts it into the MPDU, thereby reducing the steps of constructing AAD and improving the reliability of the UHR frame header. Furthermore, one embodiment of the present application separates the encryption of the payload part of the MPDU frame body and the integrity check of the MPDU frame, so that when the MPDU is retransmitted, only the extended MIC is calculated and updated, thereby improving the communication efficiency of the retransmission.

[0071] The AP in the embodiment of the present application may be an evolved NodeB (eNB), a transmission point (TRP), a next generation NodeB (gNB) in an NR system, a base station in other future mobile communication systems, or an access node in a wireless fidelity (WiFi) system, etc. The embodiment of the present application does not limit the specific technology and specific device form adopted by the network device.

[0072] The STA in the embodiment of the present application may be a terminal device, a user equipment (UE), a mobile station (MS), a mobile terminal (MT), etc. The terminal device may be a car with communication function, a smart car, a mobile phone, a wearable device, a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (AR) terminal device, a wireless terminal device in industrial control, a wireless terminal device in self-driving, a wireless terminal device in remote medical surgery, a wireless terminal device in smart grid, a wireless terminal device in transportation safety, a wireless terminal device in smart city, a wireless terminal device in smart home, etc.

[0073] Fig.14 A flowchart of a wireless communication method provided in an embodiment of the present application. The wireless communication method can be applied to an AP or a STA, and the wireless communication method can include but is not limited to steps S100, S200, S300, and S400.

[0074] S100: Obtain an extended message integrity code MIC field according to the first frame header field.

[0075] In one embodiment, the first media access control protocol data unit MPDU frame includes a first frame header field and a frame body field. The first media access control protocol data unit MPDU frame is an original MPDU frame that is not encrypted and integrity protected, including a first frame header field and a frame body field, the first frame header field is the frame header field of the original MPDU frame, and the frame body part includes unencrypted plaintext data.

[0076] In one embodiment, an extended MIC calculation is performed based on a partial field of the first frame header field to obtain an extended message integrity code MIC field.

[0077] It should be noted that some fields of the first frame header field are shielded fields to be checked in the first frame header field, that is, fields in the first frame header field that require additional protection.

[0078] For example, the structure of the field to be checked can be as follows: Fig.15 As shown, it includes the FC-MPDU Frame Control field, the Duration field, the Sequence Number field in the SC-Sequence Control field, other subfields in the QC-Qos Control field except the TID field, and the HTC-HT Control and its extended fields. Among them, the FC field includes the Subtype field, the Retry field, the Power Management field, the More Data field, the +HTC field, and other fields filled with 0.

[0079] Since the extended MIC calculation is performed on the check field, the receiver can perform integrity check on the check field through the extended message integrity code MIC field, thereby reducing the possibility of the frame header being attacked and improving the reliability of the frame header.

[0080] In another embodiment, an extended MIC calculation is performed based on all fields of the first frame header field to obtain an extended message integrity code MIC field.

[0081] In another embodiment, an extended MIC calculation is performed based on all fields of the first frame header field and all fields of the frame body (ie, the entire first media access control protocol data unit MPDU frame) to obtain an extended message integrity code MIC field.

[0082] In one embodiment, the extended MIC calculation can adopt a password-based message authentication code CMAC mode, and use the first frame header field, the second key, and the length of the output extended message integrity code MIC field as inputs of the CMAC algorithm to calculate the extended message integrity code MIC field.

[0083] In one embodiment, the second key is the key used to calculate the extended message integrity code MIC field, which is generated during the association negotiation between the AP and the STA and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, or a newly defined temporary key, etc. This application does not specifically limit the form of the second key.

[0084] Exemplarily, AES-128 or AES-256 is used for encryption internally in the CMAC mode, and the calculation formula is ExtendedMIC=CMAC(K, M, Tlen), wherein CMAC is the CMAC algorithm defined in the special publication of the National Institute of Standards and Technology (NIST Special Publication 800-38B); K is the key for calculating the extended message integrity code MIC field; M is the masked field to be checked in the first frame header field, or all fields of the first frame header field, or all fields of the first frame header field and the frame body field (i.e., the entire first media access control protocol data unit MPDU frame); Tlen is the length of the extended message integrity code MIC field.

[0085] In one embodiment, the extended MIC calculation can adopt the Galois Message Authentication Code GMAC mode, and use the first frame header field, the second key, the concatenation of the destination address and PN value in the first frame header field, and the frame body field as inputs of the GMAC algorithm to calculate the extended message integrity code MIC field.

[0086] In one embodiment, the second key is the key used to calculate the extended message integrity code MIC field, which is generated during the association negotiation between the AP and the STA and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, or a newly defined temporary key, etc. This application does not specifically limit the form of the second key.

[0087] Exemplarily, GMAC uses AES-128 or AES-256 for encryption internally, and the calculation formula is Extended MIC = GMAC (K, IV, P, A), where GMAC is the GMAC algorithm defined in NIST Special Publication 800-38D; K is the key for calculating the extended message integrity code MIC field; IV is the concatenation of the destination address Address2 and the packet number (Packet Number, PN) value in the first frame header field, where PN is the packet number assigned to the first media access control protocol data unit MPDU frame; P is the plaintext data in the frame body, and since the extended MIC calculation does not require encryption of the plaintext data, P is empty; A is the masked field to be checked in the first frame header field, or all fields of the first frame header field, or all fields of the first frame header field and the frame body field (that is, the entire first media access control protocol data unit MPDU frame).

[0088] In one embodiment, the extended MIC calculation can adopt a hash-based message authentication code HMAC mode, and use the first frame header field, the second key, the source address Address1 in the first frame header field, and the destination address Address2 in the first frame header field as inputs of the HMAC algorithm to calculate the extended message integrity code MIC field.

[0089] In one embodiment, the second key is the key used to calculate the extended message integrity code MIC field, which is generated during the association negotiation between the AP and the STA and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, or a newly defined temporary key, etc. This application does not specifically limit the form of the second key.

[0090] Exemplarily, the calculation formula is Extended MIC=HMAC-HASH(K, A1||A2||Data), wherein HMAC-HASH is a hash algorithm; K is the key for calculating the extended message integrity code MIC field; A1 is the source address Address1 in the first frame header field; A2 is the destination address Address2 in the first frame header field; Data is the masked field to be checked in the first frame header field, or all fields of the first frame header field, or all fields of the first frame header field and the frame body field (i.e., the entire first media access control protocol data unit MPDU frame); || is a connection symbol.

[0091] S200: Encrypt the plaintext data in the frame body field to obtain a ciphertext data field.

[0092] In one embodiment, additional authentication data AAD needs to be constructed before the encryption calculation. The additional authentication data AAD is constructed based on some fields in the first frame header field that will not change when the first media access control protocol data unit MPDU frame is retransmitted, and the additional authentication data AAD is used as input for the encryption calculation.

[0093] It should be noted that the masked field to be checked may change when the first media access control protocol data unit MPDU frame is retransmitted and is not included in the additional authentication data AAD.

[0094] In one embodiment, the additional authentication data AAD, the plaintext data in the frame body field, the first key and the random number Nonce are used as four inputs of the encryption calculation module, and the encryption MIC field and the ciphertext data field are obtained after encryption calculation.

[0095] In one embodiment, the first key is generated during the association negotiation between the AP and the STA, and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, etc. This application does not specifically limit the form of the first key.

[0096] In one embodiment, the first key may be the same as the second key, and in another embodiment, the first key may be different from the second key.

[0097] In one embodiment, the random number Nonce may be a random number ANonce generated by an AP or a random number SNonce generated by a STA.

[0098] In one embodiment, the encryption calculation may adopt CCM encryption method or GCM encryption method.

[0099] In one embodiment, it is not necessary to construct additional authentication data AAD before encryption calculation, and the plaintext data in the frame body field, the first key and the random number Nonce are used as three inputs of the encryption calculation module, and the encryption MIC field and the ciphertext data field are obtained after encryption calculation.

[0100] It should be noted that, in this embodiment, since the additional authentication data AAD is no longer constructed, the encrypted MIC field does not involve the first frame header field, and is only used to perform message integrity check on the frame body field. Therefore, when the first media access control protocol data unit MPDU frame is retransmitted, only the extended message integrity code MIC field and ECS check can be updated, thereby improving the retransmission efficiency.

[0101] In one embodiment, it is not necessary to construct additional authentication data AAD before encryption calculation, and the plaintext data in the frame body field, the first key and the random number Nonce are used as three inputs of the encryption calculation module, and the ciphertext data field is obtained after encryption calculation.

[0102] It should be noted that, in the present embodiment, the output of the encryption calculation is only the ciphertext data field, that is, it does not include the encrypted MIC field, and the encryption of the frame body field is separated from the generation of the message integrity check code of the entire first media access control protocol data unit MPDU frame. This can avoid re-encrypting the frame body field of the first media access control protocol data unit MPDU frame when retransmitting the first media access control protocol data unit MPDU frame, thereby improving the retransmission efficiency.

[0103] S300: Obtain an encryption calculation header field according to the PN value and the first key.

[0104] In one embodiment, the first key is generated during the association negotiation between the AP and the STA, and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, etc. This application does not specifically limit the form of the first key.

[0105] In one embodiment, the first key may be the same as the second key, and in another embodiment, the first key may be different from the second key.

[0106] In one embodiment, the PN value is a packet sequence number assigned according to the first media access control protocol data unit MPDU frame, and is used to detect replay attacks, wherein the PN value is pre-assigned before encryption calculation and extended MIC calculation.

[0107] S400: Obtain a second media access control protocol data unit MPDU frame according to the first frame header field, the encryption calculation header field, the ciphertext data field, and the extended message integrity code MIC field.

[0108] In one embodiment, the first frame header field, the encryption calculation header field, the ciphertext data field, and the extended message integrity code MIC field are spliced ​​to obtain a second media access control protocol data unit MPDU frame. This application does not limit the position of the extended message integrity code MIC field.

[0109] It should be noted that the second media access control protocol data unit MPDU frame is obtained by encrypting the first media access control protocol data unit MPDU frame and performing extended MIC calculation.

[0110] It should be noted that, in this embodiment, the input of the extended MIC calculation is all fields of the first frame header field and the frame body field (that is, the entire first media access control protocol data unit MPDU frame), and the obtained extended message integrity code MIC field can perform message integrity check on the entire first media access control protocol data unit MPDU frame to protect the integrity of the entire frame.

[0111] In another embodiment, the first frame header field, the encryption calculation header field, the ciphertext data field, the encryption MIC field, and the extended message integrity code MIC field are concatenated to obtain a second media access control protocol data unit MPDU frame.

[0112] Exemplarily, the extended message integrity code MIC field may be inserted after the encrypted MIC field, and the present application does not impose any limitation on the position of the extended message integrity code MIC field.

[0113] It should be noted that, in this embodiment, the input of the extended MIC calculation is a part of the first frame header field or all the fields of the first frame header field, and the obtained extended message integrity code MIC field can perform message integrity verification on the shielded to-be-checked field in the first frame header field or the entire first frame header field; the encrypted MIC field is obtained by encryption calculation, and can perform message integrity verification on the additional authentication data AAD and the frame body field or only the frame body field. The extended message integrity code MIC field and the encrypted MIC field jointly implement integrity protection for the entire first media access control protocol data unit MPDU frame.

[0114] In one embodiment, the AP or the STA may execute S500: sending a second media access control protocol data unit MPDU frame.

[0115] In one embodiment, after the sender sends the second media access control protocol data unit MPDU frame, the receiver calculates the extended message integrity code MIC field using the same method as the sender, and compares it with the extended message integrity code MIC field in the received second media access control protocol data unit MPDU frame. Only when the two are the same will the plaintext data Data be returned, otherwise the frame will be discarded, thereby achieving the purpose of protecting the first media access control protocol data unit MPDU frame.

[0116] In one embodiment, the AP or STA may also execute but is not limited to S600, S700, and S800.

[0117] S600: Obtain a second extended message integrity code MIC field according to a second frame header field, wherein the second frame header field is obtained by updating the first frame header field.

[0118] It should be noted that when the first media access control protocol data unit MPDU frame needs to be retransmitted, some frame header fields of the first media access control protocol data unit MPDU frame will change, and the first frame header field is updated to obtain the second frame header field.

[0119] In one embodiment, an extended MIC calculation is performed based on the updated second frame header field to obtain a second extended message integrity code MIC field, wherein the second extended message integrity code MIC field can be obtained based on a partial field of the second frame header field, all fields of the second frame header field, or all fields of the second frame header field and a frame body field.

[0120] S700: Obtain a third media access control protocol data unit MPDU frame according to the second frame header field, the encryption calculation header field, the ciphertext data field, and the second extended message integrity code MIC field.

[0121] It should be noted that the encryption calculation header field and the ciphertext data field do not need to be recalculated. Only the second frame header field and the second extended message integrity code MIC field need to be updated. The third media access control protocol data unit MPDU frame is updated by the second media access control protocol data unit MPDU frame.

[0122] In one embodiment, in addition to updating the frame header field and the extended message integrity code MIC field, the frame check sequence (FCS) is also recalculated as a whole and added to the third media access control protocol data unit MPDU frame.

[0123] S800: Send a third media access control protocol data unit MPDU frame.

[0124] In an embodiment, the wireless communication method further includes detection and association between network nodes, and may include step S900: sending a fourth media access control protocol data unit MPDU frame.

[0125] In one embodiment, the fourth media access control protocol data unit MPDU frame includes a protection indication field, wherein the protection indication field includes protection capability information, which is used to characterize whether the network node has the ability to process the extended message integrity code MIC field, wherein the ability to process the extended message integrity code MIC field may include but is not limited to the ability to extend MIC calculation.

[0126] In one embodiment, if Fig.16 As shown, a protection indication mark is added to the RSNXE field of the fourth media access control protocol data unit MPDU frame. The present application does not specifically limit the position of the protection indication mark.

[0127] Exemplarily, the AP announces its ability to process the extended message integrity code MIC field through a protection indication identifier carried in a beacon frame or a probe response frame.

[0128] It should be noted that the AP actively notifies the STA through the Beacon frame that it has the ability to process the extended message integrity code MIC field, or sends a probe response (Probe Response) frame after receiving the probe request (Probe Request) frame sent by the STA to indicate that it has the ability to process the extended message integrity code (MIC) field.

[0129] Exemplarily, the STA sends an Association Request frame, indicating that it has the ability to process the extended message integrity code MIC field.

[0130] It should be noted that when the STA associates with the AP, if the STA also has the ability to process the extended message integrity code MIC field, the STA indicates that it has the ability to process the extended message integrity code MIC field in the RSNXE field carried by the Association Request frame.

[0131] In one embodiment, the AP is an ultra high reliability access point multi-link device (UHR AP MLD), and the STA includes but is not limited to: a UHR non-AP STA or a UHR non-AP MLD.

[0132] In one embodiment, detection between UHR non-AP STAs or UHR non-AP MLDs uses a multi-link probe request (Multi-link Probe Request) and a multi-link probe response (Multi-link Probe Response).

[0133] Fig.17 A flowchart of a wireless communication method provided in an embodiment of the present application. The wireless communication method can be applied to an AP or a STA, and the wireless communication method can include but is not limited to steps S1000, S1100, and S1200.

[0134] S1000: Obtain an extended message integrity code MIC field according to the first frame header field.

[0135] In one embodiment, the first media access control protocol data unit MPDU frame includes a first frame header field and a frame body field. The first media access control protocol data unit MPDU frame is an original MPDU frame that is not encrypted and integrity protected, including a first frame header field and a frame body field, the first frame header field is the frame header field of the original MPDU frame, and the frame body part includes unencrypted plaintext data.

[0136] In one embodiment, an extended MIC calculation is performed based on a partial field of the first frame header field to obtain an extended message integrity code MIC field.

[0137] It should be noted that some fields of the first frame header field are shielded fields to be checked in the first frame header field, that is, fields in the first frame header field that require additional protection.

[0138] For example, the fields to be checked may be composed as follows: Fig.18As shown, it includes the FC-MPDU Frame Control field, the Duration field, the Sequence Number field in the SC-Sequence Control field, and the HTC-HT Control and its extended fields. Among them, the FC field includes the Subtype field, the Retry field, the Power Management field, the MoreData field, the +HTC field, and other fields filled with 0.

[0139] In another embodiment, an extended MIC calculation is performed based on all fields of the first frame header field to obtain an extended message integrity code MIC field.

[0140] In another embodiment, an extended MIC calculation is performed based on all fields of the first frame header field and all fields of the frame body (ie, the entire first media access control protocol data unit MPDU frame) to obtain an extended message integrity code MIC field.

[0141] In one embodiment, the extended MIC calculation can adopt a password-based message authentication code CMAC mode, and use the first frame header field, the second key, and the length of the output extended message integrity code MIC field as inputs of the CMAC algorithm to calculate the extended message integrity code MIC field.

[0142] In one embodiment, the second key is the key used to calculate the extended message integrity code MIC field, which is generated during the association negotiation between the AP and the STA and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, or a newly defined temporary key, etc. This application does not specifically limit the form of the second key.

[0143] Exemplarily, AES-128 or AES-256 is used for encryption internally in the CMAC mode, and the calculation formula is ExtendedMIC=CMAC(K, M, Tlen), wherein CMAC is the CMAC algorithm defined in the special publication of the National Institute of Standards and Technology (NIST Special Publication 800-38B); K is the key for calculating the extended message integrity code MIC field; M is the masked field to be checked in the first frame header field, or all fields of the first frame header field, or all fields of the first frame header field and the frame body field (i.e., the entire first media access control protocol data unit MPDU frame); Tlen is the length of the extended message integrity code MIC field.

[0144] In one embodiment, the extended MIC calculation can adopt the Galois Message Authentication Code GMAC mode, and use the first frame header field, the second key, the concatenation of the destination address and PN value in the first frame header field, and the frame body field as inputs of the GMAC algorithm to calculate the extended message integrity code MIC field.

[0145] In one embodiment, the second key is the key used to calculate the extended message integrity code MIC field, which is generated during the association negotiation between the AP and the STA and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, or a newly defined temporary key, etc. This application does not specifically limit the form of the second key.

[0146] Exemplarily, GMAC uses AES-128 or AES-256 for encryption internally, and the calculation formula is Extended MIC = GMAC (K, IV, P, A), where GMAC is the GMAC algorithm defined in NIST Special Publication 800-38D; K is the key for calculating the extended message integrity code MIC field; IV is the concatenation of the destination address Address2 and the packet number (Packet Number, PN) value in the first frame header field, where PN is the packet number assigned to the first media access control protocol data unit MPDU frame; P is the plaintext data in the frame body, and since the extended MIC calculation does not require encryption of the plaintext data, P is empty; A is the masked field to be checked in the first frame header field, or all fields of the first frame header field, or all fields of the first frame header field and the frame body field (that is, the entire first media access control protocol data unit MPDU frame).

[0147] In one embodiment, the extended MIC calculation can adopt a hash-based message authentication code HMAC mode, and use the first frame header field, the second key, the source address Address1 in the first frame header field, and the destination address Address2 in the first frame header field as inputs of the HMAC algorithm to calculate the extended message integrity code MIC field.

[0148] In one embodiment, the second key is the key used to calculate the extended message integrity code MIC field, which is generated during the association negotiation between the AP and the STA and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, or a newly defined temporary key, etc. This application does not specifically limit the form of the second key.

[0149] Exemplarily, the calculation formula is Extended MIC=HMAC-HASH(K, A1||A2||Data), wherein HMAC-HASH is a hash algorithm; K is the key for calculating the extended message integrity code MIC field; A1 is the source address Address1 in the first frame header field; A2 is the destination address Address2 in the first frame header field; Data is the masked field to be checked in the first frame header field, or all fields of the first frame header field, or all fields of the first frame header field and the frame body field (i.e., the entire first media access control protocol data unit MPDU frame); || is a connection symbol.

[0150] S1100: Perform verification calculation on the plain text data in the frame body field to obtain a first management message integrity code element MME field.

[0151] In one embodiment, a verification calculation is performed based on the plaintext data in the frame body field, the unmasked field of the first frame header field, and the first key to obtain the first management message integrity code element MME field. It should be noted that the first management message integrity code element MME field includes the frame body field and the first MIC field of the first media access control protocol data unit MPDU frame, wherein the first MIC field is used to perform integrity verification on the plaintext data in the frame body field and the unmasked field of the first frame header field, and the unmasked field is a field that does not change when the first media access control protocol data unit MPDU frame is retransmitted.

[0152] In one embodiment, the first key is generated during the association negotiation between the AP and the STA, and can be in any of the following forms: a pairwise temporary key PTK, a group temporary key GTK, an integrity group temporary key IGTK, a beacon frame integrity group temporary key BIGTK, etc. This application does not specifically limit the form of the first key.

[0153] In one embodiment, the first key may be the same as the second key, and in another embodiment, the first key may be different from the second key.

[0154] In one embodiment, the checksum calculation uses the BIP protocol.

[0155] In one embodiment, a verification calculation is performed based on the plaintext data in the frame body field and the first key to obtain the first management message integrity code element MME field. It should be noted that the first management message integrity code element MME field includes the frame body field and the first MIC field of the first media access control protocol data unit MPDU frame, wherein the first MIC field is used to perform integrity verification on the plaintext data in the frame body field.

[0156] In one embodiment, a verification calculation is performed based on the plaintext data in the frame body field, the first frame header field, and the first key to obtain a first management message integrity code element MME field. It should be noted that the first management message integrity code element MME field includes a frame body field and a first MIC field of a first media access control protocol data unit MPDU frame, wherein the first MIC field is used to perform integrity verification on the entire MPDU frame.

[0157] S1200: Obtain a second media access control protocol data unit MPDU frame according to the first frame header field, the first management message integrity code element MME field, and the extended message integrity code MIC field.

[0158] In one embodiment, an extended message integrity code MIC field is added to the first management message integrity code element MME field, and then spliced ​​with the first frame header field to obtain a second media access control protocol data unit MPDU frame. The present application does not limit the position of the extended message integrity code MIC field. For example, as shown in Figure 19(a), the extended message integrity code MIC field can be added after the first MIC field in the first management message integrity code element MME field.

[0159] It should be noted that, in this embodiment, the first management message integrity code element MME field includes a first MIC field. The first MIC field can be obtained by performing verification calculation based on the plaintext data in the frame body field, the unshielded field of the first frame header field, and the first key, and is used to perform integrity verification on the plaintext data in the frame body field and the unshielded field of the first frame header field, wherein the unshielded field is a field that does not change when the first media access control protocol data unit MPDU frame is retransmitted; the first MIC field can also be obtained by performing verification calculation based on the plaintext data in the frame body field and the first key, and is used to perform integrity verification on the plaintext data in the frame body field.

[0160] In another embodiment, the first frame header field and the first management message integrity code element MME field are concatenated to obtain a second media access control protocol data unit MPDU frame.

[0161] It should be noted that, in this embodiment, the first management message integrity code element MME field includes a first MIC field. The first MIC field is obtained by verification calculation based on the plaintext data in the frame body field, the first frame header field, and the first key, and is used to perform integrity verification on the entire MPDU frame. Since both the extended message integrity code MIC field and the first MIC field can perform integrity verification on the entire MPDU frame, the first MIC field in the first management message integrity code element MME field is retained.

[0162] In another embodiment, as shown in FIG. 19( b ), the extended message integrity code MIC field is replaced with the first MIC field of the first management message integrity code element MME field, and then concatenated with the first frame header field to obtain a second media access control protocol data unit MPDU frame.

[0163] It should be noted that, in this embodiment, the first management message integrity code element MME field includes a first MIC field. The first MIC field is obtained by verification calculation based on the plaintext data in the frame body field, the first frame header field, and the first key, and is used to perform integrity verification on the entire MPDU frame. Since both the extended message integrity code MIC field and the first MIC field can perform integrity verification on the entire MPDU frame, the extended message integrity code MIC field is retained.

[0164] In one embodiment, the AP or the STA may execute S1300: sending a second media access control protocol data unit MPDU frame.

[0165] In one embodiment, after the sender sends the second media access control protocol data unit MPDU frame, the receiver calculates the extended message integrity code MIC field using the same method as the sender, and compares it with the extended message integrity code MIC field in the received second media access control protocol data unit MPDU frame. Only when the two are the same will the plaintext data Data be returned, otherwise the frame will be discarded, thereby achieving the purpose of protecting the first media access control protocol data unit MPDU frame.

[0166] In one embodiment, the AP or STA may also execute but is not limited to S1400 , S1500 , and S1600 .

[0167] S1400: Obtain a second extended message integrity code MIC field according to a second frame header field, wherein the second frame header field is obtained by updating the first frame header field.

[0168] It should be noted that when the first media access control protocol data unit MPDU frame needs to be retransmitted, some frame header fields of the first media access control protocol data unit MPDU frame will change, and the first frame header field is updated to obtain the second frame header field.

[0169] In one embodiment, an extended MIC calculation is performed based on the updated second frame header field to obtain a second extended message integrity code MIC field, wherein the second extended message integrity code MIC field can be obtained based on a partial field of the second frame header field, all fields of the second frame header field, or all fields of the second frame header field and a frame body field.

[0170] S1500: Obtain a third media access control protocol data unit MPDU frame according to the second frame header field, the first management message integrity code element MME, and the second extended message integrity code MIC field.

[0171] It should be noted that the second extended message integrity code MIC field is added to the first management message integrity code element MME to obtain the third media access control protocol data unit MPDU frame; or the second extended message integrity code MIC field replaces the first MIC field of the first management message integrity code element MME to obtain the third media access control protocol data unit MPDU frame.

[0172] In one embodiment, in addition to updating the frame header field and the extended message integrity code MIC field, the frame check sequence (FCS) is also recalculated as a whole and added to the third media access control protocol data unit MPDU frame.

[0173] S1600: Send a third media access control protocol data unit MPDU frame.

[0174] In order to further illustrate the wireless communication method provided in the embodiments of the present application, the following examples are used for detailed description.

[0175] As shown in FIG. 20( a ), an embodiment of the present application includes a negotiation method for performing detection association between network nodes, which is implemented by a plurality of APs and STAs. This example takes one AP and one STA as an example, and includes the following steps:

[0176] S101: The AP announces that it has frame header protection capability through a protection indication flag carried in a Beacon frame.

[0177] It should be noted that the RSNXE field carried by the Beacon frame indicates that the AP has the frame header protection capability, that is, the AP has the capability to process the extended message integrity check MIC field, and the protection indication flag is located in the RSNXE field.

[0178] S102: The STA obtains the frame header protection capability of the AP by receiving the Beacon frame.

[0179] S103: The STA sends an Association Request frame to make an association request.

[0180] It should be noted that when a STA associates with an AP, if the STA also supports the frame header protection capability, that is, includes the ability to process the extended message integrity check MIC field, the STA identifies the frame header protection capability in the RSNXE field carried in the Association Request frame.

[0181] S104: The AP sends an Association Response frame for association response.

[0182] As shown in FIG. 20( b ), an embodiment of the present application includes another negotiation method for performing detection association between network nodes, which is implemented by a plurality of APs and STAs. This example takes one AP and one STA as an example, and includes the following steps:

[0183] S201: The STA sends a Probe Request frame to obtain the frame header protection capability of the AP.

[0184] S202: The AP identifies, through a Probe Response frame, that it has the frame header protection capability.

[0185] It should be noted that the AP indicates through the RSNXE field carried in the Probe Response frame that it has the frame header protection capability, that is, it includes the capability to process the extended message integrity check MIC field, and the protection indication flag is located in the RSNXE field.

[0186] S203: The STA sends an Association Request frame to make an association request.

[0187] It should be noted that when a STA associates with an AP, if the STA also supports the frame header protection capability, that is, includes the ability to process the extended message integrity check MIC field, the STA identifies the frame header protection capability in the RSNXE field carried in the Association Request frame.

[0188] S204: The AP sends an Association Response frame for association response.

[0189] An embodiment of the present application includes a wireless communication method, which is applied to a network node. Fig.21 It is an extended MIC calculation method based on CCMP encryption. Fig. 22 The extended MIC calculation method based on GCMP encryption includes the following steps:

[0190] S301: Perform extended MIC calculation according to the unprotected field of the frame header field to obtain an extended message integrity code MIC field.

[0191] It should be noted that the first media access control protocol data unit MPDU frame, that is, the plaintext MPDU frame includes a frame header field and a frame body field. The frame header field includes a masked field, that is, an unprotected field, which is used for extending the MIC calculation; the frame header field also includes an unmasked field for constructing AAD.

[0192] S302: Construct AAD according to the unmasked field of the frame header field.

[0193] It should be noted that the unshielded field of the frame header field refers to a field that does not change when the MPDU frame is retransmitted. The unprotected field in S301 is a masked field, wherein the unprotected field in S301 and the unshielded field in S302 together constitute the frame header field.

[0194] S303: Use AAD, random number Nonce, plaintext data Data and key as four inputs of the encryption module to perform encryption calculation to obtain the ciphertext data field and the encryption MIC field.

[0195] It should be noted that the random number Nonce is obtained based on the frame header field and the PN value, wherein the PN value is pre-assigned for the plaintext MPDU frame, and the key is negotiated and determined by the network nodes when performing detection association.

[0196] S304: Obtain the encryption calculation header field according to the PN value and the key.

[0197] It should be noted that the PN value is pre-assigned for the plaintext MPDU frame, and the key is negotiated and determined by the network nodes when performing detection association. The encrypted calculation header field encrypted with CCMP is the CCMP header field, and the encrypted header field encrypted with GCMP is the GCMP field.

[0198] S305: sequentially concatenate the frame header field, the encryption header field, the ciphertext data field, the encryption MIC field and the extended message integrity code MIC field to obtain an encrypted media access control protocol data unit MPDU frame.

[0199] It should be noted that the present application does not limit the specific location of the extended MIC field, and the encrypted media access control protocol data unit MPDU frame will also add the FCS field to form the final extended CCMP frame or GCMP frame.

[0200] An embodiment of the present application includes a wireless communication method, which is applied to a network node. Fig.23 It is another extended MIC calculation method based on CCMP encryption. Fig.24 Another extended MIC calculation method based on GCMP encryption includes the following steps:

[0201] S401: Perform extended MIC calculation according to the frame header field to obtain an extended message integrity code MIC field.

[0202] It should be noted that the first media access control protocol data unit MPDU frame, that is, the plaintext MPDU frame includes a frame header field and a frame body field, and the extended MIC calculation is performed according to all fields of the frame header field.

[0203] Since the entire frame header field is used as the input of the extended MIC calculation, that is, the extended message integrity code MIC field can realize the message integrity check of the entire frame header, and there is no need to construct AAD.

[0204] S402: The random number Nonce, the plaintext data Data and the key are used as three inputs of the encryption module to perform encryption calculations to obtain a ciphertext data field and an encrypted MIC field.

[0205] It should be noted that the random number Nonce is obtained based on the frame header field and the PN value, wherein the PN value is pre-assigned for the plaintext MPDU frame, and the key is negotiated and determined by the network nodes when performing detection association.

[0206] S403: Obtain the encryption calculation header field according to the PN value and the key.

[0207] It should be noted that the PN value is pre-assigned for the plaintext MPDU frame, and the key is negotiated and determined by the network nodes when performing detection association. The encrypted calculation header field encrypted with CCMP is the CCMP header field, and the encrypted header field encrypted with GCMP is the GCMP field.

[0208] S404: sequentially concatenate the frame header field, the encryption header field, the ciphertext data field, the encryption MIC field and the extended message integrity code MIC field to obtain an encrypted media access control protocol data unit MPDU frame.

[0209] It should be noted that the present application does not limit the specific location of the extended MIC field, and the encrypted media access control protocol data unit MPDU frame will also add the FCS field to form the final extended CCMP frame or GCMP frame.

[0210] Fig.25 The CCMP frame format after extension through S301-S305 or S401-S404 is shown, that is, the second media access control protocol data unit MPDU frame, that is, the media access control protocol data unit MPDU frame after extended MIC calculation and encryption, Fig.26 The GCMP frame format after being extended by S301-S305 or S401-S404 is shown.

[0211] An embodiment of the present application includes a wireless communication method, which is applied to a network node. Fig. 27 It is another extended MIC calculation method based on CCMP encryption. Fig.28 Another extended MIC calculation method based on GCMP encryption includes the following steps:

[0212] S501: Perform extended MIC calculation according to the frame header field and the frame body field to obtain an extended message integrity code MIC field.

[0213] It should be noted that the first media access control protocol data unit MPDU frame, that is, the plaintext MPDU frame includes a frame header field and a frame body field, that is, the extended MIC calculation is performed based on the entire MPDU frame.

[0214] Since the entire MPDU frame is used as the input of the extended MIC calculation, that is, the extended message integrity code MIC field can realize the message integrity check of the entire MPDU frame, and there is no need to construct AAD.

[0215] S502: The random number Nonce, the plaintext data Data and the key are used as three inputs of the encryption module to perform encryption calculation to obtain a ciphertext data field.

[0216] It should be noted that the random number Nonce is obtained based on the frame header field and the PN value, where the PN value is pre-assigned for the plaintext MPDU frame, and the key is negotiated and determined by the network nodes when performing detection association. Since the extended message integrity code MIC field can perform message integrity verification on the entire MPDU frame, the encryption calculation in this step only encrypts the plaintext data.

[0217] S503: Obtain the encryption calculation header field according to the PN value and the key.

[0218] It should be noted that the PN value is pre-assigned for the plaintext MPDU frame, and the key is negotiated and determined by the network nodes when performing detection association. The encrypted calculation header field encrypted with CCMP is the CCMP header field, and the encrypted header field encrypted with GCMP is the GCMP field.

[0219] S504: sequentially concatenate the frame header field, the encryption header field, the ciphertext data field and the extended message integrity code MIC field to obtain an encrypted media access control protocol data unit MPDU frame.

[0220] It should be noted that the present application does not limit the specific location of the extended MIC field, and the encrypted media access control protocol data unit MPDU frame will also add the FCS field to form the final extended CCMP frame or GCMP frame.

[0221] Fig.29 The CCMP frame format after S501-S504 expansion is shown. Fig.30 The GCMP frame format after extension through S501-S504 is shown.

[0222] The embodiment of the present application includes a wireless communication method, which is applied to a network node and is an extended MIC calculation method taking BIP protection as an example, and specifically includes the following steps:

[0223] S601: Perform extended MIC calculation according to the frame header field to obtain an extended message integrity code MIC field.

[0224] It should be noted that the first media access control protocol data unit MPDU frame, that is, the plaintext MPDU frame includes a frame header field and a frame body field, and the extended MIC calculation is performed according to all fields of the frame header field.

[0225] Since the entire frame header field is used as the input of the extended MIC calculation, that is, the extended message integrity code MIC field can realize the message integrity check of the entire frame header, there is no need to construct AAD.

[0226] S602: Perform verification calculation according to the plaintext data Data in the frame body field and the key to obtain a management message integrity code element MME field carrying the first MIC field.

[0227] It should be noted that the key is negotiated and determined by the network nodes when performing detection association, the plaintext data Data in the frame body field is the payload part, and the first MIC field contained in the management message integrity code element MME field is used to perform message integrity check on the frame body field.

[0228] S603: sequentially concatenate the frame header field, the management message integrity code element MME field and the extended message integrity code MIC field to obtain an encrypted media access control protocol data unit MPDU frame.

[0229] It should be noted that the present application does not limit the specific location of the extended MIC field. The encrypted media access control protocol data unit MPDU frame will also add the FCS field to form the final extended BIP frame, wherein the first MIC field in the management message integrity code element MME field is used to perform message integrity check on the frame body field, and the extended message integrity code MIC field is used to perform message integrity check on the frame header field.

[0230] The embodiment of the present application includes a wireless communication method, which is applied to a network node and is another extended MIC calculation method taking BIP protection as an example, and specifically includes the following steps:

[0231] S701: Perform extended MIC calculation according to the frame header field and the frame body field to obtain an extended message integrity code MIC field.

[0232] It should be noted that the first media access control protocol data unit MPDU frame, ie, the plaintext MPDU frame, includes a frame header field and a frame body field, and the extended MIC calculation is performed based on the frame header field and the frame body field (ie, the entire MPDU frame).

[0233] Since the entire MPDU frame is used as the input of the extended MIC calculation, that is, the extended message integrity code MIC field can realize the message integrity check of the entire MPDU frame, there is no need to construct AAD.

[0234] S702: Perform verification calculation based on the plain text data Data in the frame header field and the frame body field and the key to obtain a management message integrity code element MME field carrying the first MIC field.

[0235] It should be noted that the key is negotiated and determined by the network nodes when performing detection association, the plaintext data Data in the frame body field is the payload part, and the first MIC field contained in the management message integrity code element MME field is used to perform message integrity check on the entire MPDU frame.

[0236] S703: Concatenate the frame header field and the management message integrity code element MME field in sequence to obtain an encrypted media access control protocol data unit MPDU frame.

[0237] It should be noted that the encrypted media access control protocol data unit MPDU frame will also add the FCS field to form the final extended BIP frame. Since both the first MIC field and the extended message integrity code MIC field in the management message integrity code element MME field can be used to perform message integrity check on the entire MPDU frame, only one of them can be retained. In this example, the first MIC field in the management message integrity code element MME field is retained.

[0238] The embodiment of the present application includes a wireless communication method, which is applied to a network node and is another extended MIC calculation method taking BIP protection as an example, and specifically includes the following steps:

[0239] S801: Perform extended MIC calculation according to the frame header field and the frame body field to obtain an extended message integrity code MIC field.

[0240] It should be noted that the first media access control protocol data unit MPDU frame, ie, the plaintext MPDU frame, includes a frame header field and a frame body field, and the extended MIC calculation is performed based on the frame header field and the frame body field (ie, the entire MPDU frame).

[0241] Since the entire MPDU frame is used as the input of the extended MIC calculation, that is, the extended message integrity code MIC field can realize the message integrity check of the entire MPDU frame, there is no need to construct AAD.

[0242] S802: Perform verification calculation based on the plain text data Data in the frame header field and the frame body field and the key to obtain a management message integrity code element MME field carrying the first MIC field.

[0243] It should be noted that the key is negotiated and determined by the network nodes when performing detection association, the plaintext data Data in the frame body field is the payload part, and the first MIC field contained in the management message integrity code element MME field is used to perform message integrity check on the entire MPDU frame.

[0244] S803: Replace the first MIC field in the management message integrity code element MME field with the extended message integrity code MIC field to obtain an encrypted media access control protocol data unit MPDU frame.

[0245] It should be noted that the encrypted media access control protocol data unit MPDU frame will also add the FCS field to form the final extended BIP frame. Since both the first MIC field and the extended message integrity code MIC field in the management message integrity code element MME field can be used to perform message integrity check on the entire MPDU frame, only one of them can be retained. In this example, the extended message integrity code MIC field is retained.

[0246] Fig.31 Schematic diagram of a network node structure provided by an embodiment of the present application. Fig.31 As shown, the network node includes a memory 1100 and a processor 1200. The number of the memory 1100 and the processor 1200 may be one or more. Fig.31 In the embodiment, a memory 1100 and a processor 1200 are taken as an example; the memory 1100 and the processor 1200 in the device may be connected via a bus or other means. Fig.31 The example of connecting through bus is taken in the following.

[0247] The memory 1100 is a computer-readable storage medium that can be used to store software programs, computer executable programs, and modules, such as program instructions / modules corresponding to the wireless communication method provided in any embodiment of the present application. The processor 1200 implements the above-mentioned wireless communication method by running the software programs, instructions, and modules stored in the memory 1100.

[0248] The memory 1100 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function. In addition, the memory 1100 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 1100 may further include a memory remotely arranged relative to the processor 1200, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0249] An embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute a method for wireless communication as provided in any embodiment of the present application.

[0250] An embodiment of the present application also provides a computer program product, including a computer program or computer instructions, wherein the computer program or computer instructions are stored in a computer-readable storage medium, a processor of a computer device reads the computer program or computer instructions from the computer-readable storage medium, and the processor executes the computer program or computer instructions, so that the computer device performs a method for wireless communication as provided in any embodiment of the present application.

[0251] The system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of the system architecture and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are equally applicable to similar technical problems.

[0252] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0253] In hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0254] The terms "component", "module", "system", etc. used in this specification are used to represent computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, an execution thread, a program, or a computer. By way of illustration, both applications running on a computing device and a computing device can be components. One or more components may reside in a process or an execution thread, and a component may be located on a computer or distributed between two or more computers. In addition, these components may be executed from various computer-readable media having various data structures stored thereon. Components may communicate, for example, through local or remote processes based on signals having one or more data packets (e.g., data from two components interacting with another component between a local system, a distributed system, or a network, such as the Internet interacting with other systems through signals).

Claims

1. A wireless communication method, used for a network node, characterized in that: The method comprises: The first media access control protocol data unit MPDU frame includes a first frame header field and a frame body field; According to the first frame header field, an extended message integrity code MIC field is obtained; Perform encryption calculation on the plaintext data in the frame body field to obtain a ciphertext data field; According to the PN value and the first key, an encryption calculation header field is obtained; According to the first frame header field, the encryption calculation header field, the ciphertext data field, and the extended message integrity code MIC field, a second media access control protocol data unit MPDU frame is obtained, wherein the second media access control protocol data unit MPDU frame is an encrypted media access control protocol data unit MPDU frame.

2. The wireless communication method according to claim 1, characterized in that: The obtaining, according to the first frame header field, an extended message integrity code MIC field, comprises: According to the plaintext data in the first frame header field and the frame body field, an extended message integrity code MIC field is obtained, or, An extended message integrity code MIC field is obtained according to the first field of the first frame header field, wherein the first field is a field to be checked.

3. The wireless communication method according to claim 2, characterized in that: The first field is the entire field of the first frame header field, or the first field is a partial field of the first frame header field.

4. The wireless communication method according to claim 3, characterized in that: The obtaining, according to the first frame header field, an extended message integrity code MIC field, comprises: Using a password-based message authentication code CMAC mode, according to the first frame header field, the second key and the length, an extended message integrity code MIC field is obtained; The length is the length of the extended message integrity code MIC field.

5. The wireless communication method according to claim 3, characterized in that: The obtaining, according to the first frame header field, an extended message integrity code MIC field, comprises: The Galois Message Authentication Code (GMAC) mode is adopted to obtain an extended message integrity code (MIC) field according to the splicing of the first frame header field, the second key, the destination address and the PN value.

6. The wireless communication method according to claim 3, characterized in that: The obtaining, according to the first frame header field, an extended message integrity code MIC field, comprises: A hash-based message authentication code HMAC mode is adopted to obtain an extended message integrity code MIC field according to the first frame header field, the second key, the source address and the destination address.

7. The wireless communication method according to any one of claims 4 to 6, characterized in that: The second key includes one of the following: Pairwise transient key PTK, group transient key GTK, integrity group transient key IGTK, beacon frame integrity group transient key BIGTK or custom transient key.

8. The wireless communication method according to claim 1, characterized in that: The method further comprises: According to the first frame header field, additional authentication data AAD is obtained, wherein the additional authentication data AAD is used for encryption calculation.

9. The wireless communication method according to claim 8, characterized in that: The step of performing encryption calculation on the plaintext data in the frame body field to obtain a ciphertext data field includes: The additional authentication data AAD, the plaintext data in the frame body field, the first key and the random number are encrypted and calculated to obtain an encrypted MIC field and a ciphertext data field.

10. The wireless communication method according to claim 1, characterized in that: The step of performing encryption calculation on the plaintext data in the frame body field to obtain a ciphertext data field includes: The plaintext data in the frame body field, the first key and the random number are encrypted and calculated to obtain an encrypted MIC field and a ciphertext data field.

11. The wireless communication method according to claim 1, characterized in that: The step of performing encryption calculation on the plaintext data in the frame body field to obtain a ciphertext data field includes: The plaintext data in the frame body field, the first key and the random number are encrypted and calculated to obtain a ciphertext data field.

12. The wireless communication method according to any one of claims 9 to 10, characterized in that: The method of obtaining a second media access control protocol data unit MPDU frame according to the first frame header field, the encryption calculation header field, the ciphertext data field, and the extended message integrity code MIC field includes: A second media access control protocol data unit MPDU frame is obtained according to the first frame header field, the encryption calculation header field, the ciphertext data field, the encryption MIC field, and the extended message integrity code MIC field.

13. The wireless communication method according to claim 1, characterized in that: The method further comprises: Send the second media access control protocol data unit MPDU frame.

14. The wireless communication method according to claim 13, characterized in that: After sending the second media access control protocol data unit MPDU frame, the method further includes: According to the second frame header field, a second extended message integrity code MIC field is obtained, wherein the second frame header field is updated by the first frame header field; Obtain a third media access control protocol data unit MPDU frame according to the second frame header field, the encryption calculation header field, the ciphertext data field, and the second extended message integrity code MIC field; Send the third media access control protocol data unit MPDU frame.

15. The wireless communication method according to claim 1, characterized in that: The method further comprises: A fourth media access control protocol data unit MPDU frame is sent, wherein the fourth media access control protocol data unit MPDU frame includes a protection indication field for indicating a capability of the network node to process the extended message integrity code MIC field.

16. The wireless communication method according to claim 15, characterized in that: The protection indication field includes protection capability information, where the protection capability information is used to characterize the capability of the network node to process the extended message integrity code MIC field.

17. A wireless communication method, used for a network node, characterized in that: The method comprises: The first media access control protocol data unit MPDU frame includes a first frame header field and a frame body field; According to the first frame header field, an extended message integrity code MIC field is obtained; Performing verification calculation on the plaintext data in the frame body field to obtain a first management message integrity code element MME field; A second media access control protocol data unit MPDU frame is obtained according to the first frame header field, the first management message integrity code element MME field, and the extended message integrity code MIC field.

18. The wireless communication method according to claim 17, characterized in that: The obtaining, according to the first frame header field, an extended message integrity code MIC field, comprises: Obtaining an extended message integrity code MIC field according to all fields of the first frame header field and the plaintext data in the frame body field; or, Obtaining an extended message integrity code MIC field according to all fields of the first frame header field, wherein all fields are fields to be checked; or, An extended message integrity code MIC field is obtained according to a partial field of the first frame header field, wherein the partial field is a field to be checked.

19. The wireless communication method according to claim 18, characterized in that: The obtaining, according to the first frame header field, an extended message integrity code MIC field, comprises: Using a password-based message authentication code CMAC mode, according to the first frame header field, the second key and the length, an extended message integrity code MIC field is obtained; The length is the length of the extended message integrity code MIC field.

20. The wireless communication method according to claim 18, characterized in that: The obtaining, according to the first frame header field, an extended message integrity code MIC field, comprises: The Galois message authentication code GMAC mode is adopted, and the extended message integrity code MIC field is obtained according to the splicing of the first frame header field, the second key, the destination address and the PN value.

21. The wireless communication method according to claim 18, characterized in that: The obtaining, according to the first frame header field, an extended message integrity code MIC field, comprises: A hash-based message authentication code HMAC mode is adopted to obtain an extended message integrity code MIC field according to the first frame header field, the second key, the source address and the destination address.

22. The wireless communication method according to any one of claims 19 to 21, characterized in that: The second key includes one of the following: Pairwise transient key PTK, group transient key GTK, integrity group transient key IGTK, beacon frame integrity group transient key BIGTK or custom transient key.

23. The wireless communication method according to claim 17, characterized in that: The performing verification calculation on the plaintext data in the frame body field to obtain the first management message integrity code element MME field includes: The plaintext data in the frame body field and the first key are verified and calculated to obtain a first management message integrity code element MME field carrying the first MIC field, wherein the first management message integrity code element MME field includes the first MIC field.

24. The wireless communication method according to claim 23, characterized in that: The obtaining, according to the first frame header field, the first management message integrity code element MME field, and the extended message integrity code MIC field, of a second media access control protocol data unit MPDU frame comprises: Adding the extended message integrity code MIC field to the first management message integrity code element MME field to obtain a second management message integrity code element MME field; A second media access control protocol data unit MPDU frame is obtained according to the first frame header field and the second management message integrity code element MME field.

25. The wireless communication method according to claim 17, characterized in that: The performing verification calculation on the plaintext data in the frame body field to obtain the first management message integrity code element MME field includes: The first frame header field, the plaintext data in the frame body field and the first key are verified and calculated to obtain a first management message integrity code element MME field, wherein the first management message integrity code element MME field includes a first MIC field.

26. The wireless communication method according to claim 25, characterized in that: The obtaining, according to the first frame header field, the first management message integrity code element MME field, and the extended message integrity code MIC field, of a second media access control protocol data unit MPDU frame comprises: According to the first frame header field and the first management message integrity code element MME field, a second media access control protocol data unit MPDU frame is obtained. or, Replace the first MIC field in the first management message integrity code element MME field with the extended message integrity code MIC field to obtain a second management message integrity code element MME field; According to the first frame header field and the second management message integrity code element MME field, a second media access control protocol data unit MPDU frame is obtained.

27. The wireless communication method according to claim 17, characterized in that: The method further comprises: Send the second media access control protocol data unit MPDU frame.

28. The wireless communication method according to claim 27, characterized in that: After sending the second media access control protocol data unit MPDU frame, the method further includes: According to the second frame header field, a second extended message integrity code MIC field is obtained, wherein the second frame header field is updated by the first frame header field; Obtain a third media access control protocol data unit MPDU frame according to the second frame header field, the first management message integrity code element MME field, and the second extended message integrity code MIC field; Send the third media access control protocol data unit MPDU frame.

29. A wireless communication device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When at least one of the programs is executed by at least one of the processors, the method according to any one of claims 1 to 28 is implemented.

30. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to execute the method according to any one of claims 1 to 28.

31. A computer program product comprising a computer program or computer instructions, characterized in that The computer program or the computer instructions are stored in a computer-readable storage medium, and a processor of a computer device reads the computer program or the computer instructions from the computer-readable storage medium. The processor executes the computer program or the computer instructions, so that the computer device performs the method according to any one of claims 1 to 28.

Images