Frame exchange security implementation method for MAP system, AP and non-AP working station

Abstract

The invention provides an MAP system frame exchange security implementation method, an AP and a non-AP working station. The MAP system further comprises a second AP. The first AP includes a transceiver and a control circuit. A transceiver transmits and receives frames over the wireless network. The control circuitry sends a protected frame to a non-AP station associated with the second AP and receives a response frame to the protected frame from the non-AP station.

Description

Technical Field

[0001] The present invention relates to an electronic device, and in particular, to an access point AP and a method for implementing coordinated beamforming security. Background Art

[0002] In a wireless network with multiple access points (MAP) systems, multiple APs can coordinate transmissions to reduce interference. This includes coordinated beamforming (CBF) to increase system throughput. An example of the latter is called coordinated spatial reuse (CSR).

[0003] In some coordination scenarios, the AP needs to exchange frames with a client (non-AP working station) of another basic service set BSS in the same MAP system. For example, in CBF, the AP may need to perform detection to collect the channel state information CSI of the coordinated AP client so that during CBF transmission, appropriate channel cancellation can be performed to reduce interference.

[0004] However, when a protected frame is protected as a protected frame, additional protection is required, such as the message integrity code MIC, which requires a security key and packet number PN to decrypt and check replay, and how to detect with the client of another BSS needs to be solved. Summary of the invention

[0005] A simplified summary of one or more aspects is presented below to provide a basic understanding of these aspects. This summary is not a comprehensive overview of all intended aspects, and is neither intended to identify key or important elements of all aspects, nor to delineate the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to a more detailed description that is presented later.

[0006] An embodiment of the present invention provides a first access point AP in a multiple access point MAP system of a wireless network. The MAP system also includes a second AP. The first AP includes a transceiver and a control circuit. The transceiver sends and receives frames on the wireless network. The control circuit sends a protected frame to a non-AP work station associated with the second AP, and receives a response frame to the protected frame from the non-AP work station.

[0007] One embodiment of the present invention also provides a non-AP workstation associated with a first AP in a multiple access point (MAP) system of a wireless network. The MAP system also includes a second AP. The non-AP workstation includes a transceiver and a control circuit. The transceiver sends and receives frames on the wireless network. The control circuit receives a protected frame from the second AP and sends a response frame to the protected frame to the second AP.

[0008] An embodiment of the present invention also provides a method for implementing frame exchange security in a MAP system of a wireless network. The method is applicable to a first AP. The MAP system includes a first AP and a second AP. The method includes the following steps. The first AP sends a protected frame to a non-AP workstation associated with the second AP, and receives a response frame to the protected frame from the non-AP workstation.

[0009] An embodiment of the present invention also provides a method for implementing frame exchange security in a MAP system of a wireless network. The MAP system includes a first AP and a second AP. The method is applicable to a non-AP workstation associated with a first AP in the MAP system of the wireless network. The MAP system also includes a second AP. The method includes the following steps. The non-AP workstation receives a protected frame from the second AP and sends a response frame to the protected frame to the second AP. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The present invention may be more fully understood by reading the following detailed description and referring to the accompanying drawings, in which:

[0011] Figure 1 A schematic diagram of a multiple access point MAP system 100 according to an embodiment of the present invention is shown;

[0012] Figure 2 It is shown that according to one embodiment of the present invention, Figure 1 Schematic diagram of a data transmission sequence in a MAP system 100;

[0013] Figure 3 It is shown that according to one embodiment of the present invention, Figure 1 Schematic diagram of a data transmission sequence in a MAP system 100;

[0014] Figure 4 It is shown that according to one embodiment of the present invention, Figure 1 Schematic diagram of a data transmission sequence in a MAP system 100;

[0015] Figure 5 It is shown that according to one embodiment of the present invention, Figure 1 Schematic diagram of a data transmission sequence in a MAP system 100;

[0016] Figure 6 It is shown that according to one embodiment of the present invention, Figure 1 Schematic diagram of a data transmission sequence in a MAP system 100;

[0017] Figure 7 It is shown that according to one embodiment of the present invention, Figure 1A flowchart of a method for implementing coordinated beamforming security in a MAP system 100 applied to a first access point AP1;

[0018] Figure 8 It is shown that according to one embodiment of the present invention, Figure 1 FIG. 1 is a flowchart of a method for implementing coordinated beamforming security in a MAP system 100 applied to a second non-AP working station STA2. DETAILED DESCRIPTION

[0019] The technical terms in this specification are used in the technical field. If there is an explanation or definition of certain technical terms in this specification, the technical terms in this part will take precedence over the explanation or definition elsewhere. The present invention of each embodiment has one or more technical features. Where possible, a person of ordinary skill in the art can selectively implement some or all of the technical features of the present invention, or selectively combine these technical features of the present invention.

[0020] Figure 1 FIG. 1 is a schematic diagram of a multiple access point MAP system 100 according to some embodiments of the present invention. Figure 1 As shown, the MAP system 100 includes a first access point AP AP1, a second AP AP2, a first non-AP workstation STA1, and a second non-AP workstation STA2. The first AP AP1 and the first non-AP workstation STA1 have a first basic service set BSS, and the second AP AP2 and the second non-AP workstation STA2 have a second BSS. In some embodiments, the first AP AP1 includes a transceiver 102 and a control circuit 104. The control circuit 104 is electrically coupled to the transceiver 102. The second AP AP2 includes a transceiver 106 and a control circuit 108. The control circuit 108 is electrically coupled to the transceiver 106. In some embodiments, the transceivers 102 and 106 send and receive frames on the wireless network. The control circuit 104 sends a protected frame to the second non-AP workstation STA2 associated with the second AP AP2. The control circuit 104 receives a response frame to the protected frame from the second non-AP workstation STA2. In some embodiments, the protected frame may be a beamforming report polling (BFRP) frame, a control frame, or a trigger frame, but the present invention is not limited thereto. Specifically, the control circuit of the first AP AP1 sends an announcement frame to the second AP AP2 before sending the protected frame. The announcement frame includes multiple security parameters to encrypt the protected frame. In some embodiments, the multiple security parameters include an indicator of a security key. The multiple security parameters also include a packet number PN associated with the security key.

[0021] In some embodiments, the protected frame is encrypted by a unified security key distributed on the MAP system 100, or by a shared security key transmitted from the second AP AP2 through a backhaul or fronthaul connecting the first AP AP1 and the second AP AP2. In some embodiments, the protected frame is encrypted by a non-shared security key of the first AP AP1.

[0022] Next, after receiving the response frame from the second access point AP2, the control circuit 104 of the first access point AP1 starts a transmission sequence to send protected frames to the first non-AP work station STA1 and the second non-AP work station STA2. The control circuit 104 of the first access point AP1 receives the channel state information (CSI) of the first work station STA1 and the second work station STA2 for coordinated beamforming (CBF). In some embodiments, when the security key is a unified key, the unified key is a group key distributed in the MAP system 100 for such sharing scenarios. The PN included in the announcement frame is derived by the first access point AP1 from a common multi-link device (CMLD) before sending the announcement frame. The CMLD, for example, is a virtual host responsible for information distribution between APs or AP MLDs, or a master access point or master access point MLD responsible for group key updates. When a client, such as a non-AP work station that does not belong to the same BSS as the first access point AP1, connects or associates to the MAP system 100, the unified key is sent in a probe response frame or a reassociation response frame.

[0023] When the security key is a unified key, the first access point AP1 may update the unified key for its associated client, i.e., the first non-AP work station STA1, in a beacon frame. The second access point AP2 may update the unified key for its associated client, i.e., the second non-AP work station STA2, in a beacon frame. When the security key is a unified key, the first access point AP1 and the second access point AP2 encrypt the protected frame using the same key. In some embodiments, the protected frame may be a beamforming report polling (BFRP) frame.

[0024] When the security key is a shared key, the first access point AP1 can share a shared key with the second access point AP2 to encrypt protected frames, including BFRP. Depending on the target client of the BFRP, the first access point AP1 uses different keys for encryption. For example, ensure that the target client is the second non-AP workstation STA2. When the target client is associated with the first BSS, the first access point AP1 encrypts the protected frame using its own key. When the target client is not associated with the first BSS, the first access point AP1 encrypts the protected frame using the key of the second access point AP2 (i.e., the key of the second BSS). In some embodiments, when there are multiple clients, for MU (MIMO or OFDMA) situations, and multiple clients are associated with different BSSs, the first access point AP1 encrypts the protected frame using its own key, or encrypts the protected frame using the key of other BSSs. In some embodiments, the key selection can be based on the BSS of the target client's resource unit (RU) in the physical layer protocol data unit (PPDU) or the BSS of the target client's resource address (RA) in the protected frame. That is, different RUs or frames may be encrypted by different keys. In some embodiments, additional indicators or negotiation of key selection need to be obtained in advance to specify the key to be used.

[0025] When the security key is a non-shared key, the first access point AP1 always encrypts the protected frame with its own key. When the protected frame is sent as a BFRP to clients of other BSSs, the clients of other BSSs need to know the key. The client needs to maintain multiple keys, which increases the complexity. In some embodiments, the non-shared key is indicated in the BFRP by the transmitter address (TA) or other AP ID, such as BSSID.

[0026] exist Figure 1In some embodiments, the first non-AP workstation STA1 includes a transceiver 110 and a control circuit 112. The second non-AP workstation STA2 includes a transceiver 114 and a control circuit 116. Taking the second non-AP workstation STA2 as an example, the transceiver 114 sends and receives frames on the wireless network. The control circuit 116 receives the protected frame from the second access point AP2 and sends a response frame in response to the protected frame to the second access point AP2. In some embodiments, the protected frame is decrypted by a unified security key distributed on the MAP system 100, or by a shared security key distributed from the first access point AP1 to the second access point AP2 through a backhaul or a fronthaul connecting the first access point AP1 and the second access point AP2. In some embodiments, the second non-AP workstation STA2 derives the unified security key or the shared security key from the first management frame transmitted by the first access point AP1 during the association with the first access point AP1. The first management frame is a beacon frame, a probe response frame, or a reassociation response frame. In some embodiments, the second non-AP station STA2 derives the update of the unified security key or the shared security key from a second management frame transmitted by the first access point AP1 after associating with the first access point AP1.

[0027] In some embodiments, the protected frame is decrypted by the non-shared security key of the second access point AP2. The second non-AP workstation STA2 derives the non-shared security key from the management frame transmitted by the first access point AP1. The non-shared security key is distributed to the first access point AP1 by the second access point AP2 through the backhaul or forwardhaul connecting the first access point AP1 and the second access point AP2.

[0028] In some embodiments, the non-AP station identifies the security key used to decrypt the protected frame by an identifier carried in the protected frame. The second non-AP station STA2 maintains a PN space identified by the identifier and the security key. The identifier is a transmitter address TA or a BSSID.

[0029] Figure 2 It is shown that according to some embodiments of the present invention, Figure 1 Schematic diagram of the data transmission sequence in the MAP system 100. Figure 2 In some embodiments, the security key includes a unified key or a shared key. Figure 2As shown, the first AP AP1 sends an announcement frame (labeled as Announce) to the second AP AP2. The announcement frame includes information about the security key and an optional PN for the detection sequence. After the first AP AP1 receives the announcement frame from the second AP AP2, the second AP AP2 sends a response frame RSP to the first AP AP1. After receiving the response frame RSP from the second AP AP2, the first AP AP1 starts the detection sequence and sends a null data packet announcement (NDPA) using frame NDPA1, a null data packet (NDP) using frame NDP1, and a protected frame BFRP1 to the first non-AP working station STA1 and the second non-AP working station STA2 in sequence. Specifically, the first AP AP1 sends the NDPA using frame NDPA1, the NDP using frame NDP1, and the protected frame BFRP1 to the first non-AP working station STA1 of the first BSS during the detection sequence. The first AP AP1 sends the NDPA using frame NDP1, the NDP using frame NDP1, and the protected frame BFRP1 to the second non-AP working station STA2 of the second BSS during the detection sequence. The sounding sequence of the first AP AP1 may include transmission frames NDPA1 and NDP1, and a protected frame BFRP1. The PPDU carrying NDP1 is a multi-spatial stream PPDU with spatial stream NSS1. The PPDU carrying NDP2 is a multi-spatial stream PPDU with spatial stream NSS2. The first AP AP1 and the second AP AP2 are capable of transmitting PPDUs with multiple spatial streams and are equipped with multiple antennas.

[0030] Afterwards, the first non-AP work station STA1 sends its CSI to the first AP AP1 using frame CSI11, and the second non-AP work station STA2 simultaneously sends its CSI to the first AP AP1 using frame CSI21 in response to the protected frame BFRP1 received from the first AP AP1. After the first AP AP1 receives the CSI from the first non-AP work station STA1 and the second non-AP work station STA2, the second AP AP2 starts a detection sequence and sends NDPA using frame NDPA2, NDP using frame NDP2, and protected frame BFRP2 to the first non-AP work station STA1 and the second non-AP work station STA2 in sequence. Specifically, the second AP AP2 sends NDPA using frame NDPA2, NDP using frame NDP2, and protected frame BFRP2 to the second non-AP work station STA2 through the second BSS during the detection sequence. During the detection sequence, the second AP AP2 sends the NDPA frame NDPA2, the NDP frame NDP2, and the protected frame BFRP2 to the first non-AP station STA1 through the first AP AP1 and the first BSS. The detection sequence of the second AP AP2 may include the transmission frames NDPA2 and NDP2, and the protected frame BFRP2. Figure 2 In some embodiments, there is no frame exchange sequence (FES) between the frames CSI11, CSI21 and the frame NDPA2.

[0031] exist Figure 2 In certain embodiments, when no re-key occurs in the unified key or the shared key, the announcement frame does not include information of the security key. When the security key is a unified key, the PN included in the announcement frame is derived from the CMLD by the first AP AP1 before transmitting the announcement frame. When the security key is a shared key, the PN included in the announcement frame is determined by the first AP AP1. When the security key is a shared key, the protected frame BFRP1 further includes an additional indicator to indicate which shared key is used. The shared key may come from other BSSs or other APs in the MAP system, or may be an internal key of the protected frame BFRP1, or an internal key of the protected frame BFRP2.

[0032] Figure 3 It is shown that according to some embodiments of the present invention, Figure 1 Schematic diagram of the data transmission sequence in the MAP system 100. Figure 3 As shown, Figure 3 and Figure 2 The main difference between Figure 3In the figure, after the first working station STA1 sends its CSI to the first AP AP1 using frame CSI11, and the second non-AP working station STA2 simultaneously sends its CSI to the first AP using frame CSI21, there is a frame exchange sequence (marked as FES). After the first non-AP working station STA1 sends its CSI to the first AP AP1 using frame CSI11, and the second non-AP working station STA2 simultaneously sends its CSI to the first AP using frame CSI21, the second AP AP2 sends a request (marked as Request) frame to the first AP AP1 to obtain an updated PN. After receiving the request from the second AP AP2, the first AP AP1 sends a response frame RSP2 to the second AP AP2. The second AP AP2 then starts a detection sequence in response to receiving the response RSP2 containing the updated PN from the first AP AP1. In the figure, the first AP AP1 sends a response frame RSP2 to the second AP AP2. Figure 3 In some embodiments, after the first AP AP1 receives the announcement frame, the second AP AP2 sends a response RSP1 to the first AP AP1, so that the first AP AP1 starts the detection sequence after receiving the response RSP1 from the second AP AP2.

[0033] Figure 4 It is shown that according to some embodiments of the present invention, Figure 1 Schematic diagram of the data transmission sequence in the MAP system 100. Figure 4 As shown, Figure 4 and Figure 2 The main difference is that in Figure 4 In the example, the first non-AP station STA1 uses the frame CSI11 to send its CSI to the first AP AP1, and the second non-AP station STA2 uses the frame CSI21 to send its CSI to the first AP at the same time. Then, the first AP AP1 uses the TXS frame TXS to share a transmission opportunity (TXOP) with the second AP. This TXOP enables the second AP AP2 to use the TXOP originally obtained by the first AP AP1. The second AP AP2 starts a response sequence in response to sending a response frame RSP2 to the first AP AP1. Figure 4 In some embodiments, after receiving the announcement frame from the first AP AP1, the second AP AP2 sends a response frame RSP1 to the first AP AP1 so that the first AP AP1 starts a response sequence in response to receiving the response frame RSP1 from the second AP AP2.

[0034] exist Figure 2-Figure 4In certain embodiments, when the security key is a unified key, a host such as a virtual CMLD or a master AP MLD or a master AP is responsible for generating or updating the security key and maintaining the PN. The first AP AP1 or the second AP AP2 within the MAP system 100 obtains the security key from the CMLD. When the security key is a unified key, the first non-AP work station STA1 or the second non-AP work station STA2 obtains the security key from the (re)association response frame or the probe response during association, or if a security key update occurs, the first non-AP work station STA1 or the second non-AP work station STA2 obtains the security key from the beacon frame or the management frame after association. The first non-AP work station STA1 and the second non-AP work station STA2 only need to maintain one additional key.

[0035] exist Figure 2-Figure 4 In certain embodiments, when the security key is a shared key or a non-shared key, the first AP AP1 and the second AP AP2 generate their own security keys and update each other's security keys through a beacon frame or a backhaul or a forwardhaul to perform CBF. When the security key is a shared key or a non-shared key, the first non-AP work station STA1 or the second non-AP work station STA2 obtains the security key in a beacon frame or a management frame containing security keys of other BSSs required to perform CBF. The security key in the beacon frame can be identified by a BSSID. The first non-AP work station STA1 or the second non-AP work station STA2 identifies the security key to be used through the transmitter address (TA) or BSSID of the protected frame RFRP1 or RFRP2. When the security key is a shared key or a non-shared key, the number of keys that the first non-AP work station STA1 or the second non-AP work station STA2 needs to maintain corresponds to the complexity.

[0036] Table 1 shows an example of a unified key message design.

[0037]

[0038]

[0039] The data sizes in Table 1 are shown in octets, but the invention is not limited thereto. In some embodiments, the key length depends on the security protocol used for protection. If no re-keying occurs, the key may be optional.

[0040] Table 2 shows an example message design for a shared secret key.

[0041] Element ID length Element ID Extensions BBSID1 Key PN BBSID2 Key PN 1 1 1 1 64 8 1 64 8

[0042] The data sizes in Table 2 are shown in octets, but the present invention is not limited thereto. As shown in Table 2, multiple keys (e.g., two keys) may be shared. The BSSID may be replaced by another identifier, such as the AP MLD ID, or a mixture of multiple identifiers, such as a concatenation of the BSSID plus the AP MLD ID.

[0043] Figure 5 It is shown that according to some embodiments of the present invention, Figure 1 Schematic diagram of the data transmission sequence in the MAP system 100. Figure 5 In certain embodiments, the first AP AP1 (e.g., the control circuit 104 of the first AP AP1) sends information of a security key and an optional PN to the second AP AP2 via a backhaul 500 so that the second AP AP2 knows the security key and the PN of the response sequence. Then, the first AP AP1 starts the response sequence, sends the NDPA using the frame NDPA1, sends the NDP using the frame NDP1, and sends the protected frame BFRP1 to the first non-AP work station STA1 and the second non-AP work station STA2. After receiving the protected frame BFRP1, the first non-AP work station STA1 sends its CSI to the first AP AP1 using the frame CSI11. After receiving the protected frame BFRP1, the second non-AP work station STA2 sends its CSI to the first AP AP1 using the frame CSI21.

[0044] After the first access point AP1 receives the CSI of the first non-AP workstation STA1 and the second non-AP workstation STA2, the second access point AP2 starts the transmission sequence, using the frames NDPA2, NDP2 and the protected frame BFRP2 to send NDPA to the first non-AP workstation STA1 and the second non-AP workstation STA2 in sequence. After receiving the protected frame BFRP2, the first non-AP workstation STA1 uses the frame CSI12 to send its CSI to the second access point AP2. After receiving the protected frame BFRP2, the second workstation STA2 uses the frame CSI22 to send its CSI to the second access point AP2. Figure 5 In some embodiments, the security key may include a unified key or a shared key. The first access point AP1 updates the PN (when incremented) and the security key (when re-keyed) to the second access point AP2 via backhaul 500. The update needs to be completed in time before the transmission frame BFRP2. Figure 5 In some embodiments, there is no frame exchange sequence (FES) between the frames CSI11, CSI21 and the frame NDPA2.

[0045] Figure 6 According to some embodiments of the present invention, Figure 1Schematic diagram of the data transmission sequence in the MAP system 100. Figure 6 In some embodiments, the security key may include a unified key or a shared key. Figure 6 As shown, Figure 6 and Figure 5 The main difference is that in Figure 6 In the embodiment, the first access point AP1 sends a protected frame BFRP1 including a security key and an optional PN to the second access point AP2 for transmitting a sequence. It is assumed that the second access point AP2 can receive, decode or decrypt the protected frame BFRP1 with the security key. After receiving the protected frame BFRP1 from the first access point AP1, the second access point AP2 sends a response frame RSP1 to the first access point AP1. The second access point AP2 decodes and decrypts the protected frame BFRP1 from the first access point AP1 to obtain the security key and the optional PN for transmitting a sequence.

[0046] Likewise, in some embodiments, the second access point AP2 sends a protected frame BFRP2 containing a security key and an optional PN to the first access point AP1. After receiving the protected frame BFRP2 from the second access point AP2, the first access point AP1 sends a response frame RSP2 to the second access point AP2. The first access point AP1 decodes and decrypts the protected frame BFRP2 from the second access point AP2 to obtain the security key and the PN used for the transmission sequence. Figure 6 In some embodiments, there may be a gap between the frames CSI11, CSI21 and the frame NDPA2. Figure 3 Frame Exchange Sequence FES or Figure 4 Frame TXS in.

[0047] Figure 7 According to some embodiments of the present invention, Figure 1 Flow chart of a coordinated beamforming security implementation method applied to a first access point AP1 in a MAP system 100 in FIG. MAP system includes a first access point (eg, Figure 1 The first access point AP1 in the example, the second access point (eg, Figure 1 The second access point AP2 in the first non-AP workstation (for example, Figure 1 The first working station STA1 in the embodiment and the second non-AP working station (for example, Figure 1The first access point and the first non-AP work station have a first basic service set (BSS), and the second access point and the second non-AP work station have a second BSS. The coordinated beamforming security implementation method of the present invention includes the following steps. The first access point sends a protected frame to the second non-AP work station associated with the second access point (step S700). The first access point receives a response frame from the second non-AP work station to the protected frame (step S702).

[0048] Figure 8 According to some embodiments of the present invention, Figure 1 Flow chart of a coordinated beamforming security implementation method applied to a second non-AP workstation STA2 in a MAP system 100 in FIG. MAP system includes a first access point (eg, Figure 1 The first access point AP1 in the example, the second access point (eg, Figure 1 The second access point AP2 in the first non-AP workstation (for example, Figure 1 The first working station STA1 in the embodiment and the second non-AP working station (for example, Figure 1 The first access point and the first non-AP work station have a first basic service set (BSS), and the second access point and the second non-AP work station have a second BSS. The coordinated beamforming security implementation method of the present invention includes the following steps. The second non-AP work station receives a protected frame from the second access point (step S800). After receiving the protected frame, the second non-AP work station sends a response frame to the second access point (step S802).

[0049] The foregoing description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects. Therefore, the claims are not intended to be limited to the various aspects shown herein, but should be given a full scope consistent with the claims text, wherein unless explicitly stated, the reference to the elements in the singular form is not intended to represent "one and only one", but to represent "one or more". The word "exemplary" is used herein to represent "used as an example, instance or illustration". Any aspect described as "exemplary" herein is not necessarily interpreted as being preferred or advantageous over other aspects. Unless otherwise explicitly stated, the term "some" refers to one or more. Combinations such as "at least one of A, B or C", "one or more of A, B or C", "at least one of A, B and C", "one or more of A, B and C" and "A, B, C or any combination thereof" include any combination of A, B and / or C, and may include multiple A, multiple B or multiple C. Specifically, phrases such as "at least one of A, B, or C," "one or more of A, B, or C," "at least one of A, B and C," "one or more of A, B, and C," and "A, B, C, or any combination thereof" may be only A, only B, only C, A and B, A and C, B and C, or A and B and C, wherein any such combination may include one or more members of A, B, or C. All structural and functional equivalents of the elements throughout the various aspects of the description of the present invention that are known or will later be known to those of ordinary skill in the art are expressly incorporated herein by reference and are intended to be covered by the claims. In addition, regardless of whether such disclosure is expressly recited in the claims, nothing disclosed herein is intended to be dedicated to the public. The terms "module," "mechanism," "element," "device," and the like may not replace the term "device." Therefore, unless a claim element is expressly recited using the phrase "device for...", no claim element should be interpreted as a device plus function.

Claims

1. A first access point AP in a plurality of access points MAP system of a wireless network, wherein the MAP system further includes a second AP, and the first AP includes: a transceiver configured to transmit and receive frames on the wireless network, and A control circuit is configured as follows: Sending a protected frame to a non-AP station associated with the second AP; and A response frame to the protected frame is received from the non-AP station.

2. The first AP as described in claim 1, wherein the protected frame is encrypted by a unified security key distributed on the MAP system, or is encrypted by a shared security key transmitted from the second AP through a backhaul or forwardhaul connecting the first AP and the second AP.

3. The first AP of claim 1, wherein the protected frame is encrypted by a non-shared security key of the first AP.

4. The first AP as described in claim 2, wherein the control circuit is further configured to send an announcement frame to the second AP before sending the protected frame, wherein the announcement frame includes a plurality of security parameters to encrypt the protected frame. 5 . The first AP as claimed in claim 4 , wherein the plurality of security parameters include an indicator indicating the security key. 6 . The first AP as described in claim 5 , wherein the plurality of security parameters further include a data packet number PN associated with the security key.

7. A non-AP workstation associated with a first AP in a plurality of access point MAP systems of a wireless network, wherein the MAP system also includes a second AP, the non-AP workstation comprising: a transceiver configured to transmit and receive frames on the wireless network, and A control circuit is configured as follows: receiving a protected frame from the second AP; and A response frame to the protected frame is sent to the second AP.

8. A non-AP workstation as described in claim 7, wherein the protected frame is decrypted by a unified security key distributed on the MAP system, or by a shared security key transmitted from the first AP to the second AP through a backhaul or forward transport connecting the first AP and the second AP.

9. A method for implementing frame exchange security in a MAP system of a wireless network, applicable to a first AP, wherein the MAP system includes a first AP and a second AP, the method comprising: Sending a protected frame to a non-AP station associated with the second AP; as well as A response frame to the protected frame is received from a non-AP working station.

10. A method for implementing frame exchange security in a MAP system of a wireless network, applicable to a non-AP workstation associated with a first AP in the MAP system of the wireless network, wherein the MAP system also includes a second AP, comprising: receiving a protected frame from the second AP; as well as A response frame to the protected frame is sent to the second AP.

Images