Identity recognition method and device and storage medium

Abstract

The invention provides an identity recognition method and device and a storage medium. The method comprises the following steps: in first mobile domain association, identifying the identity of a first communication node in a mobile domain according to pre-generated first information; in the fast roaming protocol, determining second information between the first communication node and a second communication node serving as a target node; and identifying the identity of the first communication node in the mobile domain according to the second information.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an identity recognition method, device, and storage medium. Background Art

[0002] Fast BSS transition (FT) technology effectively reduces roaming latency and is widely used in the industry. This technology requires that the station (STA) use the same Media Access Control (MAC) address before and after roaming. To ensure user privacy, random MAC address (RMA) technology allows STAs to use different MAC addresses when connecting to different access points (APs). Therefore, implementing RMA technology on STA devices to support fast roaming is a pressing issue. Summary of the Invention

[0003] In view of this, embodiments of the present application provide an identity identification method, device, and storage medium, which implement identity identification of STAs accessing with random addresses in a fast roaming scenario.

[0004] This embodiment of the present application provides an identity recognition method, including:

[0005] In the first mobility domain association, the identity of the first communication node in the mobility domain is identified according to the pre-generated first information;

[0006] In a fast roaming agreement, determining second information between the first communication node and a second communication node as a target node;

[0007] The identity of the first communication node in the mobile domain is identified according to the second information.

[0008] An embodiment of the present application provides a communication device, comprising: a memory, and one or more processors;

[0009] The memory is configured to store one or more programs;

[0010] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any one of the above embodiments.

[0011] An embodiment of the present application provides a storage medium storing a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a schematic diagram of an implementation of a Device ID solution provided by the prior art;

[0013] Figure 2 This is a schematic diagram of an implementation of an IRM solution provided by the prior art;

[0014] Figure 3a This is a schematic diagram of an implementation of a fast roaming key hierarchical structure provided by the prior art;

[0015] Figure 3b This is a schematic diagram of an implementation of a hierarchical structure of a secret key of an authenticator provided by the prior art;

[0016] Figure 4 This is a flowchart for implementing the first access of FT provided by the existing technology;

[0017] Figure 5 This is a flowchart of an implementation of FT roaming provided by existing technology;

[0018] Figure 6 This is a flow chart of an identity recognition method provided by an embodiment of the present application;

[0019] Figure 7 This is an interactive flow chart of identity recognition provided by an embodiment of the present application;

[0020] Figure 8 This is a schematic diagram of an implementation of an AP generating a new roaming key hierarchical structure provided by an embodiment of the present application;

[0021] Figure 9 This is a schematic diagram of an implementation of a STA generating a new roaming key hierarchical structure provided in an embodiment of the present application;

[0022] Figure 10 This is a schematic diagram of an implementation of an AP establishing mapping information between first information or second information and a STA, provided by an embodiment of the present application;

[0023] Figure 11 This is a schematic diagram of a frame structure configuration of an IRM element provided in an embodiment of the present application;

[0024] Figure 12 This is a schematic diagram of a frame structure configuration of device identification information provided in an embodiment of the present application;

[0025] Figure 13 This is a schematic diagram of an implementation of an AP as a source node generating a new roaming key hierarchical structure provided by an embodiment of the present application;

[0026] Figure 14 This is a schematic diagram of an implementation of an AP as a target node generating a new roaming key hierarchical structure provided by an embodiment of the present application;

[0027] Figure 15 This is a schematic diagram of an implementation of an AP as a source node establishing mapping information between an IRM and a STA, provided in an embodiment of the present application;

[0028] Figure 16 This is a schematic diagram of an implementation of an AP as a target node establishing mapping information between an IRM and a STA, provided in an embodiment of the present application;

[0029] Figure 17 This is a schematic diagram of an implementation of an AP as a source node establishing mapping information between a Device ID and a STA, provided by an embodiment of the present application;

[0030] Figure 18 This is a schematic diagram of an implementation of an AP as a target node establishing mapping information between a Device ID and a STA, provided by an embodiment of the present application;

[0031] Figure 19 This is a structural block diagram of an identity recognition device provided in an embodiment of the present application;

[0032] Figure 20 It is a structural diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The following describes the embodiments of the present application in conjunction with the accompanying drawings. The following describes the present application in conjunction with the accompanying drawings. The examples are only used to explain the present application and are not used to limit the scope of the present application.

[0034] Fiber to the Remote (FTTR) technology uses optical fiber to connect wireless routers (APs) in different rooms or locations in homes, small and medium-sized enterprises, etc., thereby providing high-bandwidth, high-reliability connections between multiple APs. It can use a point-to-multipoint optical distribution network to achieve the connection between the master control AP and the slave APs.

[0035] On traditional Wi-Fi devices, each device uses a globally unique fixed MAC address to establish a connection with the AP. Identification and authentication technologies based on device fixed MAC addresses have been widely used in the Wi-Fi industry. For example, technologies such as access control and client steering based on device MAC addresses have been included in the Wi-Fi Alliance (WFA) Easy Mesh standard and the Wi-Fi Broadband Alliance (WBA) white paper.

[0036] In recent years, user privacy and security have received increasing attention. The use of a fixed MAC address for each device can allow third parties to use MAC address sniffing technology to track and locate specific users, resulting in a series of security issues.

[0037] The RMA technology in the prior art allows users to use a random MAC address (RMA) before the device is connected to the AP, thereby avoiding sniffing attacks and tracking problems caused by fixed MAC address technology.

[0038] Existing technologies have proposed two solutions: Device ID and Identifiable Random MAC address (IRM) to address the issue of device MAC address-based functions defined by the Wi-Fi Alliance and WBA failing due to random MAC address technology, which in turn causes the network to be unable to manage devices. Among them:

[0039] Figure 1 This is a schematic diagram of an implementation of a Device ID solution provided by the prior art, such as Figure 1 As shown, the associated AP assigns an identification ID (device ID1) to the STA using a random MAC address (such as MAC1). When the STA uses a random MAC address (such as MAC2) to associate with the access point in the same ESS, the access point is informed of the device ID information to ensure that the access point side can match the STA1 using MAC2 with the STA1 that previously used MAC1, thereby ensuring that network side functions such as admission control and remote diagnosis can work properly.

[0040] Figure 2 This is a schematic diagram of an implementation of an IRM solution provided by the prior art, such as Figure 2 As shown, STA1 (using MAC1) notifies the associated AP of the random MAC address (RMA1) to be used for the next association with the access point in the ESS. When STA1 uses RMA1 to associate with the access point in the ESS next time, the associated AP can successfully match it with the previous STA1.

[0041] Fast roaming (FT) technology has been proposed to reduce the message exchange process for roaming within an Extended Service Set (ESS). Compared with traditional roaming technologies, fast roaming omits the 802.1x authentication and SAE authentication processes during the reassociation process and embeds the original four-way handshake process into the authentication association frame exchange, thereby reducing roaming handover delay.

[0042] Figure 3a This is a schematic diagram of a fast roaming key hierarchical structure provided by the prior art, such as Figure 3a As shown in the figure, the derivation method of the three-level keys PMK-R0 / PMK-R1 / PTK is briefly described.

[0043] Figure 3b This is a schematic diagram of the implementation of a hierarchical structure of the authenticator's secret key provided by the existing technology, such as Figure 3b As shown, the key hierarchy of the authenticator is described:

[0044] There is a unique R0KH in the same ESS, which is responsible for generating PMK-R0 / PMK-R1, PMKR0Name / PMKR1Name and other key-related information based on MPMK, and storing PMK-R0 / PMKR0Name and other key information;

[0045] Each AP in the same ESS has an R1KH, which is used to store key information such as PMK-R1 / PMKR1Name and generate information such as PTK.

[0046] Fast roaming is divided into the initial access and roaming processes, including:

[0047] Figure 4 This is a flowchart of the implementation of the first FT access provided by the existing technology, such as Figure 4 As shown:

[0048] In the association request and response frame exchanges, the STA and AP obtain the necessary information (except the MPMK) to generate the fast roaming hierarchical key structure;

[0049] 802.1X authentication obtains MPMK;

[0050] The four-way handshake completes the PTK negotiation.

[0051] Figure 5 This is a flowchart of an implementation of FT roaming provided by the existing technology, such as Figure 5 As shown:

[0052] The authentication request frame and the response frame interact to complete the STA's fast roaming identity authentication

[0053] The reassociation request frame and the response frame interact to complete the association function.

[0054] It should be noted that the first communication node in the embodiment of the present application may also be referred to as a first communication device; the second communication node may also be referred to as a second communication device.

[0055] An embodiment of the present application proposes an identity identification scheme for a workstation (STA) using random address access (IRM) and fast roaming (FT). This scheme ensures that, in scenarios where the STA uses different MAC addresses before and after roaming, the STA and the AP can identify that the devices with different MAC addresses point to the same STA or configure new key information for the STA after roaming, thereby ensuring that the STA after roaming can achieve fast roaming access according to the fast roaming key hierarchy structure.

[0056] In one embodiment, Figure 6 This is a flow chart of an identity identification method provided by an embodiment of the present application. This embodiment is applied to the case where identity identification is performed on a STA accessed by a random address in a fast roaming scenario. This embodiment can be executed by the first communication node or the second communication node. For example, the first communication node can be a STA and the second communication node can be an AP. Figure 6 As shown, this embodiment includes: S110-S130.

[0057] S110 . In the first mobility domain association, identify the identity of the first communication node in the mobility domain according to pre-generated first information.

[0058] In one example, the first mobility domain association refers to the process of first access of the FT or after successful access. The first information refers to information between the first communication node and the second communication node as the source node. The first communication node and / or the second communication node identify the identity of the first communication node in the mobility domain based on the first information.

[0059] S120. In a fast roaming agreement, determine second information between the first communication node and a second communication node serving as a target node.

[0060] After the first communication node and the second communication node as the source node successfully access, the first communication node and the second communication node as the target node determine second information during the fast roaming access process or after the fast roaming successfully accesses.

[0061] S130: Identify the identity of the first communication node in the mobility domain according to the second information.

[0062] In one example, a first communication node and a second communication node serving as a target node identify the identity of the first communication node in the mobile domain based on the second information, thereby achieving a scenario in which the first communication node uses different MAC addresses before and after fast roaming. The first communication node and the second communication node can accurately identify that devices with different MAC addresses point to the same first communication node or configure new key information for the first communication node after roaming, thereby ensuring that the roaming first communication node can achieve fast roaming access based on the fast roaming key hierarchy structure.

[0063] In one embodiment, the identity recognition method further includes: determining first information between the first communication node and a second communication node serving as a source node during an initial access process or after a successful access. Before the first communication node and the second communication node serving as the source node identify the identity of the first communication node in the mobility domain based on the first information during an initial access process or after a successful access, the first communication node and the second communication node serving as the source node determine the first information between the first communication node and the second communication node serving as the source node.

[0064] In one embodiment, the fast roaming agreement includes one of the following processes: during the fast roaming access process; after the fast roaming access is successful.

[0065] In one embodiment, the first information and the second information each include one of the following: a MAC address to be used by the first communication node in the next association with a second communication node in the same mobility domain; or device identification information of the first communication node in the mobility domain to which it belongs. In one example, both the first information and the second information can be the identity information of the first communication node in the mobility domain to which it belongs. For example, the identity information can be the MAC address to be used by the first communication node in the next association with the second communication node in the same mobility domain, or the device identification information of the first communication node in the mobility domain to which it belongs.

[0066] In one embodiment, the first information and the second information are generated in at least one of the following ways: determined by the first communication node; or allocated by an associated second communication node. The associated second communication node may be a second communication node that is a source node, a second communication node that is a destination node, or a second communication node that is in the same mobility domain.

[0067] In one embodiment, the bearer information of each of the first and second messages includes at least one of the following: an EAPOL frame; an authentication frame; an association frame; a reassociation frame; a management frame; or an action frame. In one example, the EAPOL frame stands for EAP over LANs (Extensible Authentication Protocol over Local Area Networks), a security handshake protocol. In one example, in a fast roaming protocol, if a second communication node discovers that the identity information of a first communication node is invalid, it may reject the first communication node in the bearer information of the first and second messages, and include a corresponding status code, which may be invalid or unrecognizable identity information.

[0068] In one embodiment, identifying the identity of the first communication node in the mobility domain according to the pre-generated first information includes one of the following:

[0069] generating a new roaming key hierarchy structure according to the pre-generated first information, and identifying the identity of the first communication node in the mobile domain using the new roaming key hierarchy structure;

[0070] Establish mapping information between the first information and the first communication node, and use the mapping information to identify the identity of the first communication node in the mobile domain. In one example, in the first mobile domain association, the first communication node and the second communication node as the source node can generate a new roaming key hierarchy based on the first information to configure new key information for the STA of the first communication node before roaming, so that in the first mobile domain association, the first communication node and the second communication node can identify the identity of the first communication node in the mobile domain based on the new roaming key hierarchy. In one example, in the first mobile domain association, the first communication node and the second communication node as the source node can establish mapping information between the first information and the first communication node, so that the first communication node and the second communication node can identify the identity of the first communication node in the mobile domain based on the mapping information.

[0071] In one embodiment, when a new roaming key hierarchy structure is generated by a second communication node, generating a new roaming key hierarchy structure according to pre-generated first information includes:

[0072] Acquire first information through a second communication node serving as a source node;

[0073] reporting the first information to a main controller through a second communication node serving as a source node, so that the main controller generates a new roaming key hierarchy structure according to the first information;

[0074] The second communication node, which serves as the target node, receives the partial key information sent by the main controller. The main controller is responsible for generating and distributing the key. The second communication node, which serves as the source node, refers to the second communication node in the mobility domain that currently has a communication connection with the first communication node. The second communication node, which serves as the target node, refers to the second communication node in the mobility domain that will establish a communication connection with the first communication node.

[0075] In one embodiment, when the first communication node is used to generate a new roaming key hierarchy structure, generating the new roaming key hierarchy structure according to the pre-generated first information includes:

[0076] Acquire first information through a first requesting end in the first communication node;

[0077] reporting the first information to the second requesting end in the first communication node through the first requesting end in the first communication node;

[0078] generating, by the second requesting end in the first communication node, a new roaming key hierarchy structure according to the first information;

[0079] Part of the secret key information is sent to the first requesting end in the first communication node through the second requesting end in the first communication node.

[0080] In one embodiment, identifying the identity of the first communication node in the mobility domain according to the second information includes one of the following:

[0081] generating a new roaming key hierarchy structure according to the second information, and using the new roaming key hierarchy structure to identify the identity of the first communication node in the mobile domain;

[0082] Establish mapping information between the second information and the first communication node, and use the mapping information to identify the identity of the first communication node in the mobile domain. In one example, in a fast roaming agreement, the first communication node and the second communication node as the target node can generate a new roaming key hierarchy based on the second information to configure new key information for the STA of the first communication node after roaming, so that in the fast roaming agreement, the first communication node and the second communication node can identify the identity of the first communication node in the mobile domain based on the new roaming key hierarchy. In one example, in a fast roaming agreement, the first communication node and the second communication node as the source node can establish mapping information between the second information and the first communication node, so that the first communication node and the second communication node can identify the identity of the first communication node in the mobile domain based on the mapping information.

[0083] In one embodiment, when the second communication node is used to generate a new roaming key hierarchy structure, generating the new roaming key hierarchy structure according to the second information includes:

[0084] acquiring second information through a second communication node serving as a source node;

[0085] reporting the second information to the main controller through the second communication node serving as the source node, so that the main controller generates a new roaming key hierarchy structure according to the second information;

[0086] Part of the secret key information sent by the main controller is received through the second communication node serving as the target node.

[0087] In one embodiment, when the first communication node is used to generate a new roaming key hierarchy structure, generating the new roaming key hierarchy structure according to the second information includes:

[0088] Acquire second information through the first requesting end in the first communication node;

[0089] reporting the second information to the second requesting end in the first communication node through the first requesting end in the first communication node;

[0090] generating, by the second requesting end in the first communication node, a new roaming key hierarchy structure according to the second information;

[0091] Part of the secret key information is sent to the first requesting end in the first communication node through the second requesting end in the first communication node.

[0092] In one embodiment, the new roaming key hierarchy includes at least one of the following information: a first-layer key; a name of the first-layer key; a second-layer key; and a name of the second-layer key. In one example, the first-layer key may be PMK-R0, and the corresponding name of the first-layer key may be PMK-R0 Name. The second-layer key may be PMK-R1, and the corresponding name of the second-layer key may be PMK-R1 Name. In one example, the new roaming key hierarchy may also include other related derived information. In one embodiment, the partial key information includes at least one of the following: a second-layer key; and the name of the second-layer key. In one example, the second-layer key may be PMK-R1, and the corresponding name of the second-layer key may be PMK-R1 Name. In one example, the partial key information may also include other related derived information.

[0093] In one embodiment, establishing mapping information between the first information and the first communication node includes one of the following:

[0094] Establishing a mapping relationship between the first information and the MAC address adopted by the first communication node when first connecting;

[0095] A mapping relationship between the first information and a roaming key hierarchy to which the first communication node belongs is established.

[0096] In one embodiment, establishing mapping information between the second information and the first communication node includes one of the following:

[0097] Establishing a mapping relationship between the second information and the MAC address adopted by the first communication node when the first communication node is first connected;

[0098] A mapping relationship between the second information and a roaming key hierarchy to which the first communication node belongs is established.

[0099] In one embodiment, establishing mapping information between the first information and the first communication node includes:

[0100] Acquiring first information through the first communication node or the second communication node;

[0101] Mapping information between the first information and the first communication node is established through the first communication node and / or the second communication node.

[0102] In one embodiment, when a second communication node is used to establish mapping information between the first information and the first communication node, the method further includes:

[0103] The mapping information between the first information and the first communication node is sent to other second communication nodes in the same mobility domain.

[0104] In one embodiment, sending the mapping information between the first information and the first communication node to other second communication nodes in the same mobility domain includes one of the following:

[0105] directly sending mapping information between the first information and the first communication node to other second communication nodes in the same mobility domain;

[0106] The mapping information between the first information and the first communication node is sent to other second communication nodes in the same mobility domain in an indirect manner.

[0107] In one embodiment, establishing mapping information between the second information and the first communication node includes:

[0108] obtaining second information through the first communication node or the second communication node;

[0109] Mapping information between the second information and the first communication node is established through the first communication node or the second communication node.

[0110] In one embodiment, when a second communication node is used to establish mapping information between the second information and the first communication node, the method further includes:

[0111] The mapping information between the second information and the first communication node is sent to other second communication nodes in the same mobility domain.

[0112] In one embodiment, sending the mapping information between the second information and the first communication node to other second communication nodes in the same mobility domain includes one of the following:

[0113] directly sending mapping information between the second information and the first communication node to other second communication nodes in the same mobility domain;

[0114] The mapping information between the second information and the first communication node is sent to other second communication nodes in the same mobility domain in an indirect manner.

[0115] In one embodiment, the indirect manner includes: sending the mapping information to a main controller, and sending the mapping information to other second communication nodes in the same mobility domain through the main controller.

[0116] In one example, Figure 7 This is an interactive flow chart of identity identification provided by an embodiment of the present application. The interactive process of identity identification is described by taking the first communication node as STA, the second communication node as the source node as AP1, the second communication node as the target node as AP2, and the mobile domain as ESS1. Figure 7 As shown, the identity recognition process in this embodiment includes the following steps:

[0117] Step 1: During an initial mobility domain association of fast roaming or after a successful association, the STA and the associated AP1 determine first information.

[0118] Step 2: The STA and AP1 identify the identity of the STA in ESS1 (AP1 belongs to ESS1) based on the first information.

[0119] Step 3: In the fast roaming protocol or after successful association, the STA and the associated AP2 (AP2 belongs to ESS1) determine the second information.

[0120] Step 4: The STA and AP2 identify the identity of the STA in ESS1 according to the second information.

[0121] In one example, Figure 8 This is a schematic diagram of an implementation of an AP generating a new roaming key hierarchical structure provided by an embodiment of the present application, such as Figure 8 As shown, the process of the AP generating a new roaming key hierarchy includes the following steps:

[0122] Step 1: Associating with an access point (AP1) to obtain first information or second information;

[0123] Step 2: The associated access point (AP1) reports the first information or the second information to the R0KH;

[0124] Step 3: The R0KH generates a new fast roaming key hierarchy structure according to the first information or the second information;

[0125] Step 4: R0KH sends partial key information to the corresponding R1KH (AP2...APn).

[0126] In one example, Figure 9 This is a schematic diagram of an implementation of a STA generating a new roaming key hierarchical structure provided by an embodiment of the present application, such as Figure 9 As shown in FIG, the process of generating a new roaming key hierarchy structure by a STA includes the following steps:

[0127] Step 1: The S1KH in the workstation (STA) obtains the first or second information;

[0128] Step 2: The S1KH in the workstation (STA) internally reports the first or second information to the S0KH in the (STA);

[0129] Step 3: SOKH generates a new key hierarchy structure according to the first or second information;

[0130] Step 4: S0KH sends partial key information to S1KH.

[0131] In one example, Figure 10 This is a schematic diagram of an implementation of an AP establishing mapping information of first information or second information with STAs provided by an embodiment of the present application. Figure 10 As shown, the implementation process of the AP establishing mapping information between the first information or the second information and the STA includes the following steps:

[0132] Step 1: Associating with an access point (AP1) to obtain first information or second information;

[0133] Step 2: The associated access point (AP1) establishes mapping information between the first information or the second information and the STA;

[0134] Step 3: The associated access point (AP1) transmits the mapping information to other APs in the same ESS.

[0135] In one example, Figure 11 This is a schematic diagram of the frame structure configuration of an IRM element provided in an embodiment of the present application. Figure 11 As shown, the IRM frame structure also includes an IRM field, which is used to indicate the MAC address used by the STA to associate with the access point in the ESS next time.

[0136] In one example, Figure 12 This is a schematic diagram of a frame structure configuration of device identification information provided by an embodiment of the present application, such as Figure 12 As shown in FIG, the frame structure of the device identification information also includes a Device ID field, which is used to indicate the identification information allocated by the AP to the STA.

[0137] In one example, the interactive process of identity recognition is described by taking the first communication node as STA, the second communication node as source node as AP1, the second communication node as target node as AP2, the mobility domain as ESS, and the ESS including n APs (Ap1, AP2, ... APn), the first information and the second information as IRM, and the generation of a new fast roaming key hierarchy as an example. The identity recognition process in this embodiment includes the following steps:

[0138] Step 1, in the first roaming domain association, the STA carries the IRM (such as Figure 11 ), which contains the MAC address 1 that the STA will use when it next associates with the access point in the ESS.

[0139] Step 2: The STA's SOKH generates a new fast roaming key hierarchy based on the IRM information. The key information includes PMK-R0, PMKR0Name, and other related derived information.

[0140] Step 3, Figure 13 This is a schematic diagram of an implementation of an AP as a source node generating a new roaming key hierarchical structure provided by an embodiment of the present application, such as Figure 13 As shown in FIG, the process of generating a new roaming key hierarchy structure by the AP as a source node includes:

[0141] Step 31, AP1 receives the above IRM information;

[0142] Step 32: AP1 reports the above information to its R0KH.

[0143] Step 33: R0KH generates a new fast roaming key hierarchy based on the IRM information. The key information includes PMK-R0, PMKR0Name, PMK-R1, PMKR1Name, and other related derived information.

[0144] Step 34: R0KH distributes partial key information to the corresponding R1KH. The partial key information includes: PMK-R1, PMKR1Name and other related derived information.

[0145] In step 4, in the fast roaming protocol, the STA uses MAC address 1 as its own MAC address to initiate a fast roaming request to AP2. AP2 replies with a corresponding response message based on MAC address 1 and the corresponding fast roaming key hierarchy derived information.

[0146] Step 5: The reassociation request sent by the STA to AP2 carries the new IRM information, which includes the MAC address 2 used by the STA to associate with the access point in the ESS next time.

[0147] Step 6: The STA's SOKH generates a new fast roaming key hierarchy based on the IRM information. The key information includes PMK-R0, PMKR0Name, and other related derived information.

[0148] Step 7, Figure 14 This is a schematic diagram of an implementation of an AP as a target node generating a new roaming key hierarchical structure provided by an embodiment of the present application, such as Figure 14 As shown in FIG, the process of generating a new roaming key hierarchy structure by the AP as the target node includes:

[0149] Step 71: AP2 receives the IRM information.

[0150] Step 72: AP2 reports the above information to its R0KH.

[0151] Step 73: R0KH generates a new fast roaming key hierarchy. The key information includes PMK-R0, PMKR0Name, PMK-R1, PMKR1Name, and other related derived information.

[0152] In step 74, the R0KH distributes partial key information to the corresponding R1KH. The partial key information includes: PMK-R1, PMKR1Name, and other related derived information.

[0153] In one example, the interactive process of identity recognition is described by taking the first communication node as an STA, the second communication node as the source node as AP1, the second communication node as the target node as AP2, the mobility domain as an ESS, and the ESS including n APs (Ap1, AP2, ..., APn), the first information and the second information as IRMs, and the establishment of mapping information between the IRM and the STA as an example. The identity recognition process in this embodiment includes the following steps:

[0154] Step 1: In the first roaming domain association, the STA carries the IRM in the fourth frame of the four-way handshake (e.g. Figure 11 ), which contains the MAC address 1 that the STA will use when it next associates with the access point in the ESS.

[0155] Step 2: STA establishes mapping information between MAC address 1 and PMKR0Name corresponding to the STA.

[0156] Step 3, Figure 15 This is a schematic diagram of an implementation of an AP as a source node establishing mapping information between an IRM and a STA, as provided in an embodiment of the present application. Figure 15 As shown in FIG, the process of establishing mapping information between the IRM and the STA by the AP as the source node includes:

[0157] Step 31, AP1 receives the above IRM information;

[0158] Step 32: AP1 establishes a mapping between MAC address 1 and the PMKROName corresponding to the STA.

[0159] In step 33, AP1 sends the mapping information to other APs in the same ESS.

[0160] In step 4, in the fast roaming protocol (FT protocol), the STA uses MAC address 1 as its own MAC address to initiate a fast roaming request to AP2. The information carried is the fast roaming key hierarchy structure derived information corresponding to the MAC address used by the STA in the first mobility domain association.

[0161] Step 5: AP2 receives the fast roaming request, determines the fast roaming key hierarchy derivation information corresponding to the STA according to the mapping information, and replies with a corresponding response message.

[0162] Step 6: The reassociation request sent by the STA to AP2 carries new IRM information, which includes the MAC address 2 used by the STA for the next association with the access point in the ESS.

[0163] Step 7: The STA updates the mapping information between MAC address 2 and the PMKROName corresponding to the STA.

[0164] Step 8, Figure 16 This is a schematic diagram of an implementation of an AP as a target node establishing mapping information between an IRM and a STA, as provided in an embodiment of the present application. Figure 16 As shown in FIG, the process of establishing mapping information between the IRM and the STA by the AP as the target node includes:

[0165] Step 81, AP2 receives the above IRM information;

[0166] Step 82: Update the mapping between MAC address 2 and the PMKROName corresponding to the STA.

[0167] In step 83, AP2 sends the mapping information to other APs in the same ESS.

[0168] In one example, the interactive process of identity recognition is described by taking the first communication node as an STA, the second communication node as the source node as AP1, the second communication node as the target node as AP2, the mobility domain as an ESS, and the ESS including n APs (Ap1, AP2, ..., APn), the first information and the second information as device identification information (Device ID), and the establishment of mapping information between the Device ID and the STA as an example. The identity recognition process in this embodiment includes the following steps:

[0169] In step 1, during the initial mobility domain association, AP1 carries the Device ID element in the third frame of the four-way handshake (as shown in Figure 3-6). This element contains the Device ID 1 element, which AP1 assigns to the STA.

[0170] Step 2: The STA establishes mapping information between Device ID 1 and the PMKR0Name corresponding to the STA.

[0171] Step 3, Figure 17 This is a schematic diagram of an implementation of an AP as a source node establishing mapping information between a Device ID and a STA, as provided in an embodiment of the present application. Figure 17As shown in the figure, the process of establishing the mapping information between the device ID and the STA by the AP as the source node includes:

[0172] Step 31: AP1 obtains the information of the Device ID allocated to the STA;

[0173] Step 32: AP1 establishes a mapping between Device ID 1 and the PMKROName corresponding to the STA.

[0174] In step 33, AP1 sends the mapping information to other APs in the same ESS.

[0175] In step 4, in the fast roaming protocol, the STA uses a random MAC address to initiate a fast roaming request to AP2. The information carried in the request is the fast roaming key hierarchy structure derived information corresponding to the MAC address used by the STA in the first mobile domain association and the device ID information (Device ID 1).

[0176] Step 5: AP2 receives the fast roaming request, determines the fast roaming key hierarchy derivation information corresponding to the STA according to the mapping information, and replies with a corresponding response message.

[0177] Step 6: AP2 sends a reassociation response to the STA, which carries the new device ID information. This element contains the identification information Device ID 2 assigned to the STA by AP2.

[0178] Step 7: The STA updates the mapping information between Device ID 2 and the PMKR0Name corresponding to the STA.

[0179] Step 8, Figure 18 This is a schematic diagram of an implementation of an AP as a target node establishing mapping information between a Device ID and a STA, as provided in an embodiment of the present application. Figure 18 As shown in the figure, the process of establishing the mapping information between the device ID and the STA by the AP as the target node includes:

[0180] Step 81: AP2 obtains the Device ID information assigned to the STA.

[0181] Step 82: AP2 updates the mapping between Device ID 2 and the PMKROName corresponding to the STA.

[0182] In step 83, AP2 sends the mapping information to other APs in the same ESS.

[0183] In one embodiment, Figure 19This is a structural block diagram of an identity recognition device provided by an embodiment of the present application. This embodiment is applied to the first communication node or the second communication node. Figure 19 As shown, the identity recognition device in this embodiment includes: a first identifier 210 , a first determination module 220 and a second identifier 230 .

[0184] The first identifier 210 is configured to identify the identity of the first communication node in the mobile domain according to pre-generated first information during the first mobile domain association.

[0185] The first determining module 220 is configured to determine second information between the first communication node and a second communication node serving as a target node in a fast roaming agreement.

[0186] The second identifier 230 is configured to identify the identity of the first communication node in the mobile domain according to the second information.

[0187] In one embodiment, the identity recognition device further includes:

[0188] The second determining module is configured to determine the first information between the first communication node and the second communication node serving as the source node during the first access process or after successful access.

[0189] In one embodiment, the fast roaming agreement includes one of the following processes: during the fast roaming access process; after the fast roaming access is successful.

[0190] In one embodiment, the first information and the second information both include one of the following: a media access control MAC address used by the first communication node to associate with a second communication node in the same mobile domain next time; and device identification information of the first communication node in the mobile domain to which it belongs.

[0191] In one embodiment, the first information and the second information are generated in at least one of the following ways: determined by the first communication node; allocated by the associated second communication node.

[0192] In one embodiment, the bearer information of the first information and the second information includes at least one of the following: an EAPOL frame; an authentication frame; an association frame; a reassociation frame; a management frame; or an action frame.

[0193] In one embodiment, the first identifier is further configured as one of the following:

[0194] generating a new roaming key hierarchy structure according to the pre-generated first information, and identifying the identity of the first communication node in the mobile domain using the new roaming key hierarchy structure;

[0195] Mapping information between the first information and the first communication node is established, and the mapping information is used to identify the identity of the first communication node in the mobile domain.

[0196] In one embodiment, when the second communication node is used to generate a new roaming key hierarchy structure, generating the new roaming key hierarchy structure according to the pre-generated first information includes:

[0197] Acquire first information through a second communication node serving as a source node;

[0198] reporting the first information to a main controller through a second communication node serving as a source node, so that the main controller generates a new roaming key hierarchy structure according to the first information;

[0199] Part of the secret key information sent by the main controller is received through the second communication node serving as the target node.

[0200] In one embodiment, when the first communication node is used to generate a new roaming key hierarchy structure, generating the new roaming key hierarchy structure according to the pre-generated first information includes:

[0201] Acquire first information through a first requesting end in the first communication node;

[0202] reporting the first information to the second requesting end in the first communication node through the first requesting end in the first communication node;

[0203] generating, by the second requesting end in the first communication node, a new roaming key hierarchy structure according to the first information;

[0204] Part of the secret key information is sent to the first requesting end in the first communication node through the second requesting end in the first communication node.

[0205] In one embodiment, the second identifier is further configured as one of the following:

[0206] generating a new roaming key hierarchy structure according to the second information, and using the new roaming key hierarchy structure to identify the identity of the first communication node in the mobile domain;

[0207] Mapping information between the second information and the first communication node is established, and the mapping information is used to identify the identity of the first communication node in the mobile domain.

[0208] In one embodiment, when the second communication node is used to generate a new roaming key hierarchy structure, generating the new roaming key hierarchy structure according to the second information includes:

[0209] acquiring second information through a second communication node serving as a source node;

[0210] reporting the second information to the main controller through the second communication node serving as the source node, so that the main controller generates a new roaming key hierarchy structure according to the second information;

[0211] Part of the secret key information sent by the main controller is received through the second communication node serving as the target node.

[0212] In one embodiment, when the first communication node is used to generate a new roaming key hierarchy structure, generating the new roaming key hierarchy structure according to the second information includes:

[0213] Acquire second information through the first requesting end in the first communication node;

[0214] reporting the second information to the second requesting end in the first communication node through the first requesting end in the first communication node;

[0215] generating, by the second requesting end in the first communication node, a new roaming key hierarchy structure according to the second information;

[0216] Part of the secret key information is sent to the first requesting end in the first communication node through the second requesting end in the first communication node.

[0217] In one embodiment, the new roaming key hierarchy includes at least one of the following information: first-layer keys; names of first-layer keys; second-layer keys; and names of second-layer keys.

[0218] In one embodiment, the partial key information includes at least one of the following: a second-layer key; and a name of the second-layer key.

[0219] In one embodiment, establishing mapping information between the first information and the first communication node includes one of the following:

[0220] Establishing a mapping relationship between the first information and the MAC address adopted by the first communication node when first connecting;

[0221] A mapping relationship between the first information and a roaming key hierarchy to which the first communication node belongs is established.

[0222] In one embodiment, establishing mapping information between the second information and the first communication node includes one of the following:

[0223] Establishing a mapping relationship between the second information and the MAC address adopted by the first communication node when the first communication node is first connected;

[0224] A mapping relationship between the second information and a roaming key hierarchy to which the first communication node belongs is established.

[0225] In one embodiment, establishing mapping information between the first information and the first communication node includes:

[0226] Acquiring first information through the first communication node or the second communication node;

[0227] Mapping information between the first information and the first communication node is established through the first communication node and / or the second communication node.

[0228] In one embodiment, when a second communication node is used to establish mapping information between the first information and the first communication node, the method further includes:

[0229] The mapping information between the first information and the first communication node is sent to other second communication nodes in the same mobility domain.

[0230] In one embodiment, sending the mapping information between the first information and the first communication node to other second communication nodes in the same mobility domain includes one of the following:

[0231] directly sending mapping information between the first information and the first communication node to other second communication nodes in the same mobility domain;

[0232] The mapping information between the first information and the first communication node is sent to other second communication nodes in the same mobility domain in an indirect manner.

[0233] In one embodiment, establishing mapping information between the second information and the first communication node includes:

[0234] obtaining second information through the first communication node or the second communication node;

[0235] Mapping information between the second information and the first communication node is established through the first communication node or the second communication node.

[0236] In one embodiment, when a second communication node is used to establish mapping information between the second information and the first communication node, the method further includes:

[0237] The mapping information between the second information and the first communication node is sent to other second communication nodes in the same mobility domain.

[0238] In one embodiment, sending the mapping information between the second information and the first communication node to other second communication nodes in the same mobility domain includes one of the following:

[0239] directly sending mapping information between the second information and the first communication node to other second communication nodes in the same mobility domain;

[0240] The mapping information between the second information and the first communication node is sent to other second communication nodes in the same mobility domain in an indirect manner.

[0241] In one embodiment, the indirect manner includes: sending the mapping information to a main controller, and sending the mapping information to other second communication nodes in the same mobility domain through the main controller.

[0242] The identity recognition device provided in this embodiment is configured to implement Figure 6 The identity recognition method of the illustrated embodiment and the identity recognition device provided in this embodiment have similar implementation principles and technical effects, which will not be described again here.

[0243] In one embodiment, Figure 20 This is a schematic diagram of the structure of a communication device provided in an embodiment of the present application. Figure 20 As shown, the device provided by this application includes: a processor 310, a memory 320 and a communication module 330. The number of processors 310 in the device can be one or more. Figure 20 In the example, a processor 310 is used. The number of memories 320 in the device can be one or more. Figure 20 In the example, a memory 320 is used. The processor 310, memory 320 and communication module 330 of the device can be connected via a bus or other means. Figure 20 In the embodiment, the device may be a first communication node or a second communication node.

[0244] The memory 320, as a computer-readable storage medium, can be configured to store software programs, computer executable programs, and modules, such as program instructions / modules corresponding to the device of any embodiment of the present application (for example, the first identifier 210, the determination module 220, and the second identifier 230 in the identity recognition device). The memory 320 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function; the data storage area may store data created based on the use of the device, etc. In addition, the memory 320 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 320 may further include a memory remotely located relative to the processor 310, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0245] The device provided above can be configured to execute the identity recognition method provided in any of the above embodiments, and have corresponding functions and effects.

[0246] An embodiment of the present application also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used to perform an identity identification method, the method comprising: in an initial mobile domain association, identifying the identity of a first communication node in a mobile domain based on pre-generated first information; in a fast roaming agreement, determining second information between the first communication node and a second communication node as a target node; and identifying the identity of the first communication node in the mobile domain based on the second information.

[0247] It will be appreciated by those skilled in the art that the term user equipment encompasses any suitable type of wireless user equipment, such as a mobile phone, a portable data processing device, a portable web browser or a car-mounted mobile station.

[0248] In general, various embodiments of the present application may be implemented in hardware or dedicated circuits, software, logic, or any combination thereof. For example, some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device, although the present application is not limited thereto.

[0249] Embodiments of the present application may be implemented by executing computer program instructions by a data processor of a mobile device, for example, in a processor entity, or by hardware, or by a combination of software and hardware. The computer program instructions may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages.

[0250] The block diagram of any logical flow in the drawings of the present application may represent program steps, or may represent interconnected logical circuits, modules and functions, or may represent a combination of program steps and logical circuits, modules and functions. A computer program may be stored on a memory. The memory may be of any type suitable for the local technical environment and may be implemented using any suitable data storage technology, such as, but not limited to, a read-only memory (ROM), a random access memory (RAM), an optical storage device and system (a digital versatile disc (DVD) or a compact disk (CD)). Computer-readable media may include non-transient storage media. A data processor may be of any type suitable for the local technical environment, such as, but not limited to, a general-purpose computer, a special-purpose computer, a microprocessor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), and a processor based on a multi-core processor architecture.

[0251] The above are merely preferred embodiments of the present application and are not intended to limit the present application. Those skilled in the art will readily appreciate that various modifications and variations are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

Claims

1. An identity recognition method, characterized in that: include: In the first mobile domain association, the identity of the first communication node in the mobile domain is identified according to the pre-generated first information; In a fast roaming agreement, determining second information between the first communication node and a second communication node as a target node; The identity of the first communication node in the mobile domain is identified according to the second information.

2. The method according to claim 1, characterized in that The method further comprises: During the first access process or after successful access, first information between the first communication node and a second communication node as a source node is determined.

3. The method according to claim 1 or 2, characterized in that: The fast roaming agreement includes one of the following processes: during the fast roaming access process; after the fast roaming access is successful.

4. The method according to claim 1 or 2, characterized in that: The first information and the second information each include one of the following: a media access control MAC address used by the first communication node to associate with a second communication node in the same mobile domain next time; and device identification information of the first communication node in the mobile domain to which it belongs.

5. The method according to claim 1 or 2, characterized in that: The generation methods of the first information and the second information include at least one of the following: determined by the first communication node; allocated by the associated second communication node.

6. The method according to claim 1 or 2, characterized in that: The bearer information of the first information and the second information includes at least one of the following: an EAPOL frame; an authentication frame; an association frame; a reassociation frame; a management frame; and an action frame.

7. The method according to claim 1, characterized in that The identifying of the identity of the first communication node in the mobile domain according to the pre-generated first information includes one of the following: Generating a new roaming key hierarchical structure according to the pre-generated first information, and using the new roaming key hierarchical structure to identify the identity of the first communication node in the mobile domain; Mapping information between the first information and the first communication node is established, and the mapping information is used to identify the identity of the first communication node in the mobile domain.

8. The method according to claim 7, characterized in that In the case where the second communication node is used to generate a new roaming key hierarchical structure, the generating a new roaming key hierarchical structure according to the pre-generated first information includes: Acquiring first information through a second communication node serving as a source node; reporting the first information to a main controller through a second communication node serving as a source node, so that the main controller generates a new roaming key hierarchical structure according to the first information; Part of the secret key information sent by the main controller is received through the second communication node serving as the target node.

9. The method according to claim 7, characterized in that: In the case where the first communication node is used to generate a new roaming key hierarchical structure, the step of generating a new roaming key hierarchical structure according to the pre-generated first information includes: Acquire first information through a first requesting end in the first communication node; Reporting the first information to a second requesting end in the first communication node through a first requesting end in the first communication node; generating, by the second requesting end in the first communication node, a new roaming key hierarchical structure according to the first information; Part of the secret key information is sent to the first requesting end in the first communication node through the second requesting end in the first communication node.

10. The method according to claim 1, characterized in that The identifying the identity of the first communication node in the mobile domain according to the second information includes one of the following: generating a new roaming key hierarchical structure according to the second information, and using the new roaming key hierarchical structure to identify the identity of the first communication node in the mobile domain; Mapping information between the second information and the first communication node is established, and the mapping information is used to identify the identity of the first communication node in the mobile domain.

11. The method according to claim 10, characterized in that In the case where the second communication node is used to generate a new roaming key hierarchical structure, the generating a new roaming key hierarchical structure according to the second information includes: Acquiring second information through a second communication node serving as a source node; reporting the second information to the main controller through a second communication node serving as a source node, so that the main controller generates a new roaming key hierarchical structure according to the second information; Part of the secret key information sent by the main controller is received through the second communication node serving as the target node.

12. The method according to claim 10, characterized in that In the case where the first communication node is used to generate a new roaming key hierarchical structure, the generating a new roaming key hierarchical structure according to the second information includes: Acquire second information through a first requesting end in the first communication node; reporting the second information to a second requesting end in the first communication node through a first requesting end in the first communication node; generating, by the second requesting end in the first communication node, a new roaming key hierarchical structure according to the second information; Part of the secret key information is sent to the first requesting end in the first communication node through the second requesting end in the first communication node.

13. The method according to any one of claims 7 to 12, characterized in that: The new roaming key hierarchical structure includes at least one of the following information: first-layer keys; names of first-layer keys; second-layer keys; and names of second-layer keys.

14. The method according to claim 8, 9, 11 or 12, characterized in that The partial key information includes at least one of the following: a second-layer key; and a name of the second-layer key.

15. The method according to claim 7, characterized in that The establishing mapping information between the first information and the first communication node includes one of the following: Establishing a mapping relationship between the first information and the MAC address adopted by the first communication node when connecting for the first time; A mapping relationship between the first information and a roaming key hierarchy to which the first communication node belongs is established.

16. The method according to claim 10, characterized in that The establishing mapping information between the second information and the first communication node includes one of the following: Establishing a mapping relationship between the second information and the MAC address adopted by the first communication node when connecting for the first time; A mapping relationship between the second information and a roaming key hierarchy to which the first communication node belongs is established.

17. The method according to claim 7, characterized in that The establishing mapping information between the first information and the first communication node includes: Acquire first information through the first communication node or the second communication node; Mapping information between the first information and the first communication node is established through the first communication node and / or the second communication node.

18. The method according to claim 17, characterized in that In the case where the second communication node is used to establish mapping information between the first information and the first communication node, the method further includes: The mapping information between the first information and the first communication node is sent to other second communication nodes in the same mobility domain.

19. The method according to claim 18, characterized in that The sending the mapping information between the first information and the first communication node to other second communication nodes in the same mobility domain comprises one of the following: directly sending mapping information between the first information and the first communication node to other second communication nodes in the same mobility domain; The mapping information between the first information and the first communication node is sent to other second communication nodes in the same mobile domain in an indirect manner.

20. The method according to claim 10, characterized in that The establishing mapping information between the second information and the first communication node includes: Acquiring second information through the first communication node or the second communication node; Mapping information between the second information and the first communication node is established through the first communication node or the second communication node.

21. The method according to claim 20, characterized in that In the case where the second communication node is used to establish mapping information between the second information and the first communication node, the method further includes: The mapping information between the second information and the first communication node is sent to other second communication nodes in the same mobility domain.

22. The method according to claim 21, characterized in that The sending the mapping information between the second information and the first communication node to other second communication nodes in the same mobility domain comprises one of the following: directly sending mapping information between the second information and the first communication node to other second communication nodes in the same mobility domain; The mapping information between the second information and the first communication node is sent to other second communication nodes in the same mobility domain in an indirect manner.

23. The method according to claim 19 or 22, characterized in that The indirect method includes: sending the mapping information to a main controller, and sending the mapping information to other second communication nodes in the same mobile domain through the main controller.

24. A communication device, characterized in that: include: memory, and one or more processors; The memory is configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 23.

25. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 23 is implemented.

Images