Multicast frame transmission in wireless local area network
By assigning a unique GTK to each VLAN/PAN in a wireless LAN and encrypting multicast frames in the AP, the problem of multicast frames cannot be isolated is solved, and network security and transmission efficiency are improved.
Patent Information
- Application Number
- CN202410953048.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2023-10-31
- Filing Date
- 2024-07-16
- Publication Date
- 2025-05-02
AI Technical Summary
In wireless LANs, multicast frames cannot be isolated between different VLANs/PANs due to the same GTK for encryption, which has security defects. The traditional multicast to unicast conversion method poses a huge burden on CPU, memory, and air resources, and has a long delay.
By obtaining multicast frames in the AP and determining the unique GTK for the target subnet, encrypting the multicast frames using this GTK ensures that they are received and decrypted only by the client devices in the target subnet. At the same time, only the PS status of the client devices in the target subnet is checked to reduce latency and resource consumption.
The effective isolation of multicast frames between different VLANs/PANs is achieved, network security is improved, and the resource consumption and delay of AP is reduced, and the efficiency of multicast frame transmission is improved.
Smart Images
Figure CN119922759A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present disclosure relate to multicast frame transmission in a wireless local area network. Background Art
[0002] A personal area network (PAN) is a network that provides wireless communication between electronic devices in close proximity and has been rapidly developed in recent years. This technology enables efficient and convenient data transmission between various personal devices such as smartphones, laptops, and wearable devices. On the other hand, a virtual local area network (VLAN) is a technology that allows multiple devices to connect to a single local area network (LAN) while providing the functions of multiple independent LANs.
[0003] The need for PAN or VLAN stems from the growing demand for efficient and secure network connections. For example, customers such as universities or hospitals require PAN / VLAN features on wired / wireless networks. At the same time, they do not want to create too many service set identifiers (SSIDs) on access points (APs). Customers want to dynamically derive VLAN / PAN identifiers (IDs) for clients connected to the same WLAN SSID, and each VLAN / PAN should be completely isolated from other PANs / VLANs under the same WLAN SSID. BRIEF DESCRIPTION OF THE DRAWINGS
[0004] When read in conjunction with the accompanying drawings, the implementation of the present disclosure can be understood from the following detailed description. According to standard practice in the industry, various features are not drawn to scale. In fact, the size of various features can be arbitrarily increased or reduced for clarity of discussion. Some examples of the present disclosure are described with respect to the following drawings.
[0005] Figure 1 A block diagram showing an example environment in which a reference implementation of the present disclosure may be implemented;
[0006] Figure 2 An example of multiple PANs / VLANs under the same WLAN SSID implemented according to the present disclosure is shown;
[0007] Figure 3 An example of sending a multicast frame according to an implementation of the present disclosure is shown;
[0008] Figure 4 Another example of transmitting a multicast frame according to the present disclosure is shown;
[0009] Figure 5 An example of sending an uplink multicast frame according to an implementation of the present disclosure is shown;
[0010] Figure 6 An example of a segmented multicast data frame implemented according to the present disclosure is shown;
[0011] Figure 7 A flowchart illustrating an example method for sending a multicast frame implemented according to the present disclosure; and
[0012] Figure 8 An example access point according to an implementation of the present disclosure is shown. DETAILED DESCRIPTION
[0013] As mentioned above, users want to dynamically get the VLAN / PANID of client devices connected to the same WLAN SSID and use VLAN / PAN to manage client devices. For example, in the PAN project, there will be multiple PANs and / or VLANs under the same SSID. But multicast / broadcast frames are encrypted using the same GTK. This means that multicast / broadcast frames going to different VLANs / PANs are not isolated. This is a major security flaw in the PAN project.
[0014] To forward multicast frames to a VLAN / PAN, traditional solutions require converting multicast frames into unicast frames for each client in the same VLAN / PAN and then sending them to these clients individually. However, this approach places a heavy burden on the central processing unit (CPU), memory, and air resources. When an AP has dozens / hundreds of connected clients, multicast-to-unicast (M2U) will exhaust CPU, memory, and air resources. If the AP does not perform M2U, multicast frames will leak to all stations.
[0015] Therefore, the implementation of the present disclosure proposes a solution for sending multicast frames to client devices in a target subnet. According to the implementation of the present disclosure, an AP obtains a multicast frame in a wireless local area network (WLAN). The WLAN includes multiple subnets with the same SSID. The AP can use the multicast frame to determine the target subnet for receiving the multicast frame among the multiple subnets, and obtain a unique group temporary key (GTK) corresponding to the target subnet. Multiple subnets with the same SSID can be assigned multiple different GTKs, and each subnet has a corresponding GTK. Then, the AP uses the obtained unique GTK of the target subnet to encrypt the multicast frame. The encrypted multicast frame is sent to one or more client devices in the target subnet.
[0016] One or more client devices in the target subnet can receive the encrypted multicast frame and decrypt the encrypted multicast frame using the corresponding GTK. Client devices in other subnets cannot decrypt the encrypted multicast frame because they do not have the unique GTK of the target subnet. The implementation of the present disclosure can provide a unique group key GTK for each VLAN / PAN group. Therefore, the multicast frame of each VLAN / PAN will be encrypted or decrypted using its own GTK. In this case, the encrypted multicast frame will not be leaked to all client devices connected to the AP.
[0017] Other advantages of the present disclosure will be described below with reference to the reference implementation. Figures 1 to 8 , to illustrate the basic principles of the present disclosure and several reference implementations.
[0018] Figure 1 A block diagram of an example environment in which a reference implementation of the present disclosure may be implemented is shown. Figure 1 In the example environment 100, AP 102 communicates with multiple subnetworks, including subnetwork 108-1, subnetwork 108-2..., subnetwork 108-N, where N is an integer. In addition, the multiple subnetworks are under the same SSID. Each of the multiple subnetworks can be a PAN or a VLAN and include one or more client devices. For example, subnetwork 108-1 includes two client devices, subnetwork 108-2 includes three client devices, and subnetwork 108-N includes two client devices. The client devices included in the subnetworks can be any type of computing device that can join the network, for example, a smartphone, a laptop, a tablet computer, a smart home appliance, any suitable wearable device, and the like.
[0019] exist Figure 1 In an implementation of the present invention, multiple different credentials may be assigned to multiple subnets, for example, multiple pre-shared keys may be assigned to multiple subnets for AP 102. Each subnet may be assigned a pre-shared key as a credential for AP 102. Any client device may join a subnet using the credential corresponding to the subnet. The credential of one subnet in the multiple subnets may be different from the credential of another subnet in the multiple subnets.
[0020] For example, when a client device joins a wireless network provided by AP 102, the client device will send credentials to AP 102. AP 102 can then determine which subnet the client device belongs to based on the credentials. For example, the AP stores a mapping relationship between multiple subnets and corresponding credentials. When the AP receives the credentials, it will use the credentials to search for a subnet from the mapping relationship between multiple subnets and corresponding credentials. In one example, the client device sends the credentials to AP 102, and AP 102 can determine which subnet of the multiple subnets the credentials are used by. If the credentials are the same as the credentials of subnet 108-2, AP 102 will determine that the client device belongs to subnet 108-2. In this way, all devices connected to the AP can be divided into multiple subnets.
[0021] AP 102 can assign multiple different GTKs to multiple subnets under the same WLAN SSID, and each subnet has a GTK. AP 102 can send multicast frames to different subnets by using multiple different GTKs. When AP 102 needs to send a multicast frame, AP 102 first determines which subnet to send the multicast frame to. The determined subnet is used as the target subnet. Then, AP 102 finds a unique GTK for the target subnet. Next, the multicast frame will be encrypted using the unique GTK of the target subnet.
[0022] For example, AP 102 will send a multicast frame 104 to a subnet. AP 102 needs to determine which subnet among subnet 108-1, subnet 108-2, ..., and subnet 108-N the multicast frame will be sent to. In this example, it is determined that subnet 108-2 receives the multicast frame. In order to ensure that multicast frame 104 is only received by subnet 108-2, AP 102 needs to find the GTK of subnet 108-2 and encrypt multicast frame 104 using the unique GTK of subnet 108-2 to generate encrypted multicast frame 106. The encrypted multicast frame 106 is then sent to the client device in subnet 108-2.
[0023] When client devices in subnet 108-2 establish a connection with AP 102, they have already obtained the GTK of subnet 108-2. Therefore, client devices in subnet 108-2 can use the unique GTK of subnet 108-2 to decrypt the encrypted multicast frame 106. Because client devices in other subnets cannot obtain the unique GTK of subnet 108-2, even if they receive the encrypted multicast frame, they cannot decrypt the encrypted multicast frame and cannot obtain the information in the encrypted multicast frame. Therefore, the multicast frame for subnet 108-2 will not be leaked to other client devices in other subnets. For example, client devices in subnet 108-1 and subnet 108-N cannot decrypt the encrypted multicast frame and obtain the information in the encrypted multicast frame.
[0024] In addition, in traditional solutions, when sending multicast frames, the AP needs to check the power saving (PS) status of all client devices connected to the AP. If any of all client devices connected to the AP is in PS, the AP needs to buffer the multicast frame and send it out after sending the announcement traffic indication message (ATIM) or when all devices wake up. Therefore, the AP has a smaller chance of sending multicast frames immediately and the delay is longer. In some implementations of the present disclosure, when AP 102 sends a multicast frame, it only needs to check the PS status of client devices in the target subnet. For example, if AP 102 sends a multicast frame to subnet 108-2, it only needs to check the PS status of client devices in subnet 108-2. At this time, the number of client devices that need PS status checks is reduced. Therefore, AP 102 has more opportunities to send multicast frames immediately and the delay is lower than the standard method.
[0025] Figure 2 An example 200 of multiple PANs / VLANs under the same WLAN SSID is shown according to an implementation of the present disclosure. Figure 2 In the figure, there is an MPSK configuration of a wireless network SSID "AIR-TEST". In this configuration, there are three LANs under the same SSID "AIR-TEST", also known as three subnetworks. The three LANs include VLAN 1, PAN 1, and PAN 2. VLAN1 includes the credential "HELLOWORD!" and the user is DAVE. PAN1 includes the credential "%^&*(A123" and the user is STEVE. PAN2 includes the credential "123456789!" and the user is JASON. The credentials of these three LANs are the passwords to join the network provided by the AP, and the credentials of these three LANs are different. Therefore, the credentials can be used to determine the LAN to which the client device belongs. For example Figure 2As shown, the client devices connected to AP 202 are divided into three LANs, for example, VLAN 1 204, PAN 1 206, and PAN 208. In VLAN 1, there are many laptops connected to the AP. In PAN 1 and PAN 2, there are some computing devices related to users, such as mobile phones, tablets, or wearable devices. Figure 2 In a LAN, all client devices in all LANs are based on the same SSID.
[0026] For example, when a client device of user "STEVE" needs to connect to a network provided by AP 202, the password "%^&*(a123" is used. The user enters the password "%^&*(a123" into the client device, and the client device sends it to AP 202 during the handshake process. AP 202 can then determine that the password is the same as the credentials of subnetwork 206. Therefore, the client device is assigned to subnetwork 206 based on the password or the credentials.
[0027] Figure 3 An example 300 of sending a multicast frame according to an implementation of the present disclosure is shown. Figure 3 In the example, AP 302 needs to send a multicast frame 304 to a client device in a subnet 312. In one example, the multicast frame 304 is generated by AP 302. In another example, the multicast frame 304 is obtained from other devices and forwarded by AP 302. The multicast frame 304 may be an 802.3 frame or an 802.11 frame. Then, AP 302 may obtain a source address 306 in a frame header of the multicast frame 304. The source address 306 may be used to determine a unique GTK 308 corresponding to the subnet 312. The source address may store the address of the subnet, which may be used as an ID of the subnet. Then, AP 302 uses the ID of the subnet to find a unique GTK corresponding to the ID of the subnet. AP 102 may eventually obtain a unique GTK corresponding to the ID of the subnet. For example, AP 302 may obtain a mapping relationship between a plurality of GTKs and a plurality of IDs of a plurality of subnets. Then, AP 302 searches for a GTK corresponding to the ID of the subnet from the mapping relationship.
[0028] After obtaining GTK 308, AP 302 encrypts multicast frame 304 using GTK 308 to generate encrypted multicast frame 310. AP 302 may use any suitable algorithm to encrypt the multicast frame based on GTK 308. For example, the algorithm is an Advanced Encryption Standard algorithm. Then, AP 302 sends the encrypted multicast frame 310 to subnetwork 312. Subnetwork 312 includes client device 314, client device 316, and client device 318. Client devices in subnetwork 312 may receive encrypted multicast frame 312. Client devices in subnetwork 312 have stored a unique GTK for subnetwork 312. For example, when client device 314 establishes a connection with AP 302, the unique GTK for subnetwork 312 may be sent from AP 312 to client device 314 during a handshake process. GTK may be obtained by the following equation.
[0029] GTK=PRF-X(GMK,"Group key expansion",ap mac|Anonce), where "PRF-X" represents a pseudo-random function, "GMK" represents a group master key, "Group key expansion" is a string, "ap-mac" is an address, and "Anonce" is a random number.
[0030] Therefore, the client device in the subnet 312 can decrypt the encrypted multicast frame using the unique GTK of the subnet 312 and obtain the information in the multicast frame. The client devices in other subnets do not have the unique GTK for the subnet 312. Therefore, the client devices in other subnets cannot decrypt the encrypted multicast frame 310. This process avoids leaking the multicast frame to all client devices connected to the AP 302 and ensures that the multicast frame can be received only by the client devices in the subnet 312.
[0031] Figure 4 Another example 400 for sending a multicast frame according to an implementation of the present disclosure is shown. Figure 4, AP 402 obtains multicast frame 404. Multicast frame 404 is to be sent to subnet 406, and the multicast frame is not for subnet 414. For example, the source address of the multicast frame is the address of subnet 406. Unlike the conventional manner, when AP 402 sends multicast frame 404 to subnet 406, it does not need to check the PS status of all client devices connected to the AP. For example, AP 402 does not check the PS status of client devices in subnet 406 and subnet 414. Because the multicast frame is sent to subnet 406, AP 402 only checks the PS status of client devices in subnet 406. For example, subnet 406 includes client device 408, client device 410, and client device 412. Therefore, the AP checks the PS status of client device 408, client device 410, and client device 412, but does not check the PS status of client devices in subnet 414.
[0032] During the checking process, if any one of the client devices in the subnet 406 is in the PS, the AP 402 will not send the multicast frame 404 to the client devices in the subnet 406. The AP 402 needs to buffer the multicast frame 404. In one implementation, the AP 402 will first send an ATIM to the client devices 408, 410, and 412 in the subnet 406 to notify the client devices 408, 410, and 412 in the subnet 406 that there is pending traffic to be sent. Then, the AP 402 sends the multicast frame 404 to the clients in the subnet 406. In another implementation, the AP 402 waits for all the client devices in the subnet 406 to wake up. When all the client devices in the subnet 406 wake up, the AP 406 sends the multicast frame to the client devices in the subnet 406. Therefore, compared with the conventional solution of checking the PS status of all the client devices connected to the AP device, the present disclosure only checks the PS status of the client devices in the subnet, which gives the AP more opportunities to send multicast frames immediately and with lower latency than the conventional approach.
[0033] Figure 5 An example 500 for sending an uplink multicast frame according to an implementation of the present disclosure is shown. Figure 5As shown, there is a subnet 504. The subnet may include a plurality of client devices, for example, a client device 506, a client device 508, and a client device 510. The subnet is based on an AP 502. One of the client devices in the subnet 504 may send a multicast frame to the client devices in the subnet 504. For example, the client device 506 sends a multicast frame to the client devices 508 and 510. Because the client devices in the subnet are based on the AP, when the client devices in the subnet 504 need to send a multicast frame to the client devices in the subnet 504, the client devices need to send an uplink multicast frame 512 to the AP 502. Then, the AP 502 sends the uplink multicast frame to the client devices in the subnet 504.
[0034] The uplink multicast frame includes at least a receiver address (RA), a sender address (TA), and a destination address (DA). The RA can be set to the basic service set identifier (BSSID) of the AP 502, the TA can be set to the address of the client device that sends the uplink multicast frame, and the DA can be set to the multicast address. The uplink multicast frame is a unicast frame. Therefore, the uplink multicast frame is encrypted using a pairwise transient key (PTK) corresponding to the client device 506. Then, the encrypted uplink multicast frame is sent to the AP 502. The AP 502 receives the decrypted uplink multicast frame and obtains the PTK corresponding to the client device 506. Then, the AP 502 uses the obtained PTK to decrypt the encrypted uplink multicast frame. The AP 502 can further determine the ID of the subnet where the client device 506 is located, and the AP 502 can store the identification of the subnet and the identification of the client device in the subnet. Then, the AP obtains a unique GTK corresponding to the subnet 504 and encrypts the decrypted uplink multicast frame 512 using the unique GTK corresponding to the subnet 504. The encrypted uplink multicast frame is transmitted to the client devices in the subnet 504. In this case, the client device 508 and the client device 510 can receive the encrypted uplink multicast frame and decrypt the encrypted uplink multicast frame using the unique GTK corresponding to the subnet 504. Thus, transmission of multicast frames for the client devices in the subnet is achieved.
[0035] Figure 6An example 600 of a segmented multicast data frame implemented according to the present disclosure is shown. For each VLAN / PAN under an SSID, the AP manages a separate group key (GTK) using the group ID associated with it. Each VLAN / PAN is a subnet, and the group ID is the ID of the subnet. The group key is assigned and updated during the 802.1x authentication process. The group ID is added to the wireless multicast / unicast data frame. The client device can use the group ID to filter the multicast / broadcast frame before sending it to the wireless stack. Figure 6 As shown, a new type of frame is used. This frame can be called a segmented multicast data frame. The frame format of the segmented multicast data frame is redefined, for example, by inserting a group ID field into the frame header. For the sender, the group ID is used to index the corresponding group encryption key, and for the receiver, it is used to check whether the frame belongs to him.
[0036] In addition, in the segmented multicast data frame, if the frame is a multicast frame, RA is set to the multicast address. If the frame is not a multicast frame, RA is set in a normal manner. In addition, a group ID flag field is added to the segmented multicast data frame to determine whether the multicast frame is sent to the subnet. For example, if the frame is a multicast frame, and if the multicast frame is not sent to the VLAN / PAN, the group ID flag field is set to 0, which indicates that the multicast frame is processed in a normal manner. In this case, there is no need to configure the group ID field. If the group ID flag field is set to 1, it means that the multicast frame is sent to the VLAN / PAN. Then, the group ID field is set to the ID of the VLAN / PAN that receives the multicast frame.
[0037] When the AP sends a multicast frame, it sets the RA field in the frame header to the multicast address. If the multicast frame is sent to the target VLAN / PAN, the AP sets the group ID flag field in the frame header to 1. The AP then sets the group ID field in the frame header to the ID of the VLAN / PAN that receives the multicast frame. Next, the AP encrypts the multicast frame using the GTK corresponding to the target VLAN / PAN to generate an encrypted multicast frame. The encrypted multicast frame is sent to the client device in the target VLAN / PAN.
[0038] When a client device is connected to an AP and receives an encrypted multicast frame. It can determine whether the received frame is a multicast frame based on the RA field. If the RA field is not a multicast address, the client device will process the frame normally. If the RA field is a multicast address, the client device can further obtain information in the group ID flag field. The client device further determines whether the group ID flag field is a predetermined value. If the group ID flag field is 0, it indicates that the multicast frame is a normal multicast frame, and the multicast frame will be processed by the client device in a normal manner. If the group ID flag field is 1, it indicates that the multicast frame is for VLAN / PAN. The client device then obtains its own group ID and compares its own group ID with the group ID field. If its own group ID does not match the group ID field, it indicates that the multicast frame is not destined for the client device. If its own group ID matches the group ID field, it indicates that the multicast frame is destined for the client device and further processing of the multicast frame is required, for example, decrypting the multicast frame with the corresponding GTK.
[0039] In addition, group IDs can be exchanged. After the Wi-Fi Protected Access (WPA) 4-way handshake, if the client is not in the default LAN group, the AP will send an action frame to the client to notify the group ID. The client device will then confirm the AP.
[0040] Figure 7 A flow chart of an example method 700 for sending a multicast frame according to an implementation of the present disclosure is shown, and the method 700 is performed by an AP. At 702, the AP obtains a multicast frame in a wireless local area network (WLAN) that includes multiple subnets with the same service set identifier (SSID). For example, the AP 102 can generate a multicast frame, and the multicast frame includes a source address. The multicast frame can be an 802.3 / 802.11 frame. In another example, the AP 102 can obtain an uplink multicast frame from a client device connected to the AP. When a client device connected to the AP needs to send a multicast frame to a subnet including the client device, the client device first needs to send an uplink multicast frame to the AP 102. The uplink multicast frame includes at least a receiver address (RA), a sender address (TA), and a destination address (DA). The RA can be set to a basic service set identifier (BSSID), the TA can be set to the address of the client device that sends the uplink multicast frame, and the DA can be set to a multicast address.
[0041] At 704, the AP determines a target subnet for receiving the multicast frame from a plurality of subnets based on the multicast frame. For example, the multicast frame is generated by the AP. The multicast frame includes a source address, and the source address can be used to store the ID of the subnet that receives the multicast frame. The AP can then determine the target subnet from the plurality of subnets based on the address source. In another example, the AP can receive an uplink multicast frame, and can determine the client device that sends the uplink multicast frame based on the TA field of the header of the uplink multicast frame. The TA field can be used to store the address of the terminal device, which is used as the ID of the terminal device. The subnet can then be determined based on the ID of the subnet. In addition, the AP stores a mapping relationship between the subnet and the corresponding client device.
[0042] At 706, the AP obtains a unique group temporary key (GTK) of the target subnet, and multiple subnets are assigned multiple different GTKs. For example, the AP 102 can store information about the subnets and the corresponding GTKs, such as a mapping relationship between the subnets and the corresponding GTKs. If the AP 102 determines the target subnet, it can determine a unique GTK for the target subnet based on the mapping relationship. The GTK is assigned to the subnet by the AP. When a client establishes a connection with the AP 102, the AP will send the GTK of the subnet to which the client device belongs to the client device.
[0043] At 708, the AP encrypts the multicast frame using the obtained unique GTK for the target subnet. For example, after AP 102 obtains the target subnet unique GTK, AP 102 uses the obtained target subnet unique GTK to encrypt the multicast frame. Because the multicast frame is encrypted with the obtained unique GTK of the target network, only client devices in the target subnet can decrypt the encrypted multicast frame. The AP can use any suitable algorithm to encrypt the multicast frame based on the GTK. For example, the algorithm is an Advanced Encryption Standard algorithm.
[0044] At 710, the AP sends the encrypted multicast frame to one or more client devices in the target subnet. For example, after AP 102 generates the encrypted multicast frame, AP 102 sends the multicast frame to the client devices on the target subnet. Client devices connected to the AP can receive the encrypted multicast frame. However, the multicast frame is encrypted with the unique GTK of the target subnet. Therefore, only the client devices in the subnet can use the unique GTK to decrypt the encrypted multicast frame. In this case, only the client devices in the target subnet can obtain information from the multicast, while other client devices in other subnets cannot decrypt the encrypted multicast frame because the client devices in the other subnets do not have the unique GTK of the target subnet.
[0045] In this way, the AP can use the unique GTK of the target subnet to encrypt the multicast frame to send to the target subnet. Most importantly, this method can effectively prevent other client devices in other subnets from decrypting the encrypted multicast frame and obtaining the information in the multicast frame, ultimately preventing the multicast frame from being leaked to all client devices, ensuring data security.
[0046] In addition, when the AP sends a multicast frame, it only needs to check the PS status of the client devices in the target subnet. For example, if AP 102 sends a multicast frame to the subnet, it only needs to check the PS status of the client devices in the subnet. During the check, if any client device in the subnet is in PS, the AP will not send the multicast frame 404 to the client device on the subnet. The AP needs to buffer the multicast frame. In one implementation, the AP will first send an ATIM to the client devices in the subnet 406 to notify the client devices in the subnet that there is a pending business to be sent. Then, the AP sends the multicast frame to the clients in the subnet. In another implementation, the AP waits for all client devices in the subnet to wake up. When all client devices in the subnet wake up, the AP sends the multicast frame to the client devices in the subnet. Therefore, the AP has more opportunities to send multicast frames immediately, and the delay is lower than the traditional method.
[0047] Figure 8 An example AP 800 is shown according to an implementation of the present disclosure. Figure 8 As shown, the terminal device 800 includes at least one processor 810 and a memory 820 coupled to the processor 810. The memory 820 stores instructions 822, 824, 826, 828, and 830 to enable the processor 810 to perform actions according to the reference implementation of the present disclosure.
[0048] like Figure 8 As shown, the memory 820 stores instructions 822 for obtaining a multicast frame in a wireless local area network (WLAN) including multiple sub-networks having the same service set identifier (SSID). As an example, the instructions 822 are executed by the processor 810 to obtain a multicast frame.
[0049] The memory 820 further stores instructions 824 for determining a target subnet for receiving the multicast frame from among multiple subnets based on the multicast frame. For example, the instructions 824 are executed by the processor 810 to determine a target subnet for receiving the multicast frame from among multiple subnets based on the multicast frame.
[0050] like Figure 8As shown, the memory 820 also stores an instruction 826 for obtaining a unique group temporary key (GTK) of a target subnet, and multiple subnets are assigned multiple different GTKs. For example, the processor 810 executes the instruction 826 to obtain a unique group temporary key (GTK) of the target subnet. The target subnet is one of multiple subnets based on the same SSID. The AP assigns a GTK to each of the multiple subnets, and the GTK assigned to one subnet is different from the GTK assigned to another subnet. Therefore, the multiple subnets have multiple different GTKs.
[0051] The memory 820 also stores instructions 828 for encrypting the multicast frame using the obtained unique GTK for the target subnet. For example, the instructions 828 are executed by the processor 810 to encrypt the multicast frame using the obtained unique GTK for the target subnet.
[0052] like Figure 8 As shown, the memory 820 also stores instructions 830 for sending the encrypted multicast frame to one or more client devices in the target subnet. For example, the processor 810 executes the instructions 830 to send the encrypted multicast frame to one or more client devices in the target subnet. Therefore, the AP 800 can send the encrypted multicast frame without leaking the encrypted multicast frame to client devices in other subnets.
[0053] The program code or instructions for executing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes or instructions can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are realized. The program code or instructions can be executed completely on the machine, partially on the machine as an independent software package, partially on the machine, partially on a remote machine, or completely on a remote computer or server.
[0054] The program code or instructions for executing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes or instructions can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are realized. The program code or instructions can be executed completely on the machine, partially on the machine as an independent software package, partially on the machine, partially on a remote machine, or completely on a remote computer or server.
[0055] In the context of the present disclosure, a machine-readable medium may be any tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, equipment, or any suitable combination thereof. A more specific example of a machine-readable storage medium may include an electrical connection with one or more wires, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.
[0056] In addition, although the operations are described in a particular order, this should not be understood as requiring that such operations be performed in the particular order or sequence shown, or requiring that all of the operations shown be performed to obtain the desired results. In some cases, multitasking and parallel processing may be advantageous. Certain features described in the context of separate implementations may also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation may also be implemented in multiple implementations individually or in any suitable subcombination.
[0057] In the foregoing detailed description of the present disclosure, reference is made to the accompanying drawings which are part of the present disclosure, and in the accompanying drawings, examples of how to practice the present disclosure are shown by way of illustration. These examples are described in sufficient detail to enable one of ordinary skill in the art to practice the examples of the present disclosure, and it should be understood that other examples may be utilized and process, electrical and / or structural changes may be made without departing from the scope of the present disclosure.
Claims
1. A method comprising: An access point AP obtains a multicast frame in a wireless local area network WLAN, wherein the WLAN includes a plurality of sub-networks having a same service set identifier SSID; Determining, by the AP based on the multicast frame, a target subnet among the plurality of subnets for receiving the multicast frame; The AP obtains a unique group temporary key GTK for the target sub-network, and the multiple sub-networks are allocated with multiple different GTKs; encrypting the multicast frame by the AP using the obtained unique GTK for the target subnet; and The encrypted multicast frame is sent by the AP to one or more client devices in the target subnet.
2. The method of claim 1, wherein obtaining the multicast frame in the WLAN comprises: Generate a frame of a predetermined type, wherein a frame header of the frame of the predetermined type includes a receiver address field, a group identifier flag field for a sub-network, and a group identifier field for the sub-network; determining the recipient address field based on the multicast address; determining the group identifier flag field based on a predetermined value to indicate that an identifier of the target subnetwork is used in the frame of the predetermined type; as well as The group identifier field is determined based on the identifier of the target subnetwork.
3. The method according to claim 2, further comprising: The identifier for the target subnetwork is sent to the one or more client devices in the target subnetwork.
4. The method of claim 1 , wherein determining the target subnetwork among the plurality of subnetworks for receiving the multicast frame comprises: Determining a source address in a frame header of the multicast frame; as well as The target subnetwork is determined based on the source address.
5. The method of claim 1, wherein obtaining the GTK for the target subnetwork comprises: Obtaining a mapping relationship between the multiple different GTKs and the multiple sub-networks; as well as The unique GTK for the target sub-network is determined based on the mapping relationship.
6. The method of claim 1 , wherein sending the encrypted multicast frame to the one or more client devices in the target subnetwork comprises: Check the power saving PS status of all client devices in the target sub-network; Determining that all client devices in the target subnet are not in PS state; as well as The encrypted multicast frame is sent to one or more client devices in the target subnetwork.
7. The method according to claim 1, further comprising: receiving a connection request from a target client device, the connection request including credentials; and The target subnetwork is determined to include the target client device based on the credentials.
8. The method of claim 7, wherein the credentials from all of the client devices in the target network are the same.
9. The method according to claim 1, further comprising: The unique GTK is assigned to the one or more client devices during an authentication process for the one or more client devices.
10. An access point AP, comprising: at least one processor; a memory coupled to the at least one processor, the memory storing instructions that cause the at least one processor to: Obtaining a multicast frame in a wireless local area network WLAN, the WLAN comprising a plurality of subnetworks having a same service set identifier SSID; determining, based on the multicast frame, a target subnetwork among the plurality of subnetworks for receiving the multicast frame; Obtaining a unique group temporary key GTK for the target sub-network, wherein the multiple sub-networks are allocated with multiple different GTKs; Encrypting the multicast frame using the obtained unique GTK for the target subnet; and The encrypted multicast frame is sent to one or more client devices in the target subnetwork.
11. The access point of claim 10, wherein the instructions for obtaining the multicast frame in the WLAN include instructions for causing the at least one processor to: Generate a frame of a predetermined type, wherein a frame header of the frame of the predetermined type includes a receiver address field, a group identifier flag field for a sub-network, and a group identifier field for the sub-network; determining the recipient address field based on the multicast address; determining the group identifier flag field based on a predetermined value to indicate that an identifier of the target subnetwork is used in the frame of the predetermined type; as well as The group identifier field is determined based on the identifier of the target subnetwork.
12. The access point of claim 11, further comprising instructions for causing the at least one processor to: The identifier for the target subnetwork is sent to the one or more client devices in the target subnetwork.
13. The access point of claim 10, wherein the instructions for determining the target subnetwork of the plurality of subnetworks for receiving the multicast frame comprises instructions for causing the at least one processor to: determining a source address in a frame header of the multicast frame; and The target subnetwork is determined based on the source address.
14. The access point of claim 10, wherein the instructions for obtaining the GTK for the target subnetwork include instructions for causing the at least one processor to: Obtaining a mapping relationship between the multiple different GTKs and the multiple sub-networks; and The unique GTK for the target sub-network is determined based on the mapping relationship.
15. The access point of claim 10, wherein the instructions for sending the encrypted multicast frame to the one or more client devices in the target subnet include instructions for causing the at least one processor to: Check the power saving PS status of all client devices in the target sub-network; Determining that all client devices in the target subnet are not in PS state; and The encrypted multicast frame is sent to one or more client devices in the target subnetwork.
16. The access point of claim 10, further comprising instructions for causing the at least one processor to: receiving a connection request from a target client device, the connection request including credentials; and The target subnetwork is determined to include the target client device based on the credentials.
17. The access point of claim 16, wherein the credentials from all of the client devices in the target network are the same.
18. The access point of claim 16, further comprising instructions for causing the at least one processor to: The unique GTK is assigned to the one or more client devices during an authentication process for the one or more client devices.
19. A non-transitory computer-readable medium comprising instructions stored thereon, which when executed by an access point (AP) cause the AP to: Obtaining a multicast frame in a wireless local area network WLAN, the WLAN comprising a plurality of subnetworks having a same service set identifier SSID; determining, based on the multicast frame, a target subnetwork among the plurality of subnetworks for receiving the multicast frame; Obtaining a unique group temporary key GTK for the target sub-network, wherein the multiple sub-networks are allocated with multiple different GTKs; Encrypting the multicast frame using the obtained unique GTK for the target subnet; and The encrypted multicast frame is sent to one or more client devices in the target subnetwork.
20. The non-transitory computer-readable medium of claim 19, wherein obtaining the multicast frame in the WLAN comprises: Generate a frame of a predetermined type, wherein a frame header of the frame of the predetermined type includes a receiver address field, a group identifier flag field for a sub-network, and a group identifier field for the sub-network; determining the recipient address field based on the multicast address; determining the group identifier flag field based on a predetermined value to indicate that an identifier of the target subnetwork is used in the frame of the predetermined type; as well as The group identifier field is determined based on the identifier of the target subnetwork.