Wireless local area network system, communication method and apparatus

Abstract

The application provides a wireless local area network system, a communication method and device. The wireless local area network system comprises a controller, a first access point and a second access point, the first access point is associated with a first station, and the second access point is associated with a second station. The controller is configured to generate a first group temporary key GTK, and send the first GTK to the first access point and the second access point. The first access point is configured to encrypt data by using the first GTK to obtain a first message, and multicast or broadcast the first message. The first access point is configured to send the first GTK to the first station, and the second access point is configured to send the first GTK to the second station. The scheme provided by the application can improve the multicast or broadcast communication efficiency of the access point in the wireless local area network system.

Description

[0001] This application is a divisional application. The original application has the application number 202210175153.4 and the original application date is February 24, 2022. The entire contents of the original application are incorporated herein by reference. Technical Field

[0002] This application relates to the field of wireless communication, and more particularly to wireless local area network systems, communication methods and apparatus. Background Technology

[0003] In wireless local area networks (WLANs), access points (APs) can transmit messages to stations (STAs) via unicast, multicast, or broadcast. To enhance security, APs use a group transient key (GTK) to encrypt multicast or broadcast messages. During the process of a STA associating with an AP, the STA obtains the GTK from the AP. The STA then uses the GTK to decrypt multicast or broadcast messages. In practical applications, to improve wireless signal coverage, multiple APs can be combined to form a WLAN system.

[0004] In a WLAN system composed of multiple APs, each STA can only receive multicast or broadcast messages from the AP associated with it, resulting in low efficiency of AP multicast or broadcast communication. Summary of the Invention

[0005] This application provides a wireless local area network system, communication method, and apparatus. By using the same GTK, a first AP can multicast or broadcast a first message to a first STA and a second STA, thereby improving the multicast or broadcast communication efficiency of the first AP.

[0006] This application provides a WLAN system in its first aspect. The WLAN system includes an access controller (AC), a first access point (AP), and a second access point (AP). The first AP is associated with a first standby device (STA). The second AP is associated with the second STA. The AC generates a first GTK (Getting Granting Key) and sends the first GTK to both the first and second APs. The first AP encrypts data using the first GTK to obtain a first message, which it then multicasts or broadcasts. The first AP sends the first GTK to the first STA. The first STA decrypts the first message using the first GTK. The second AP sends the first GTK to the second STA. The second STA decrypts the first message using the first GTK.

[0007] In one alternative of the first aspect, the AC is used to generate the first GTK based on the group master key (GMK), the group random number, and the AC's medium access control (MAC) address.

[0008] In one alternative embodiment of the first aspect, the AC is used to send a first message to a first AP and a second AP. The first message includes a first GTK. The first message also includes at least one of the following: identifiers of the first AP and the second AP, identifiers of virtual access points (VAPs) in the first AP, identifiers of VAPs in the second AP, a key replay counter, a receive sequence counter, a group random number, and an integrity group temporary key. By adding one or more of the foregoing content, the reliability of multicast or broadcast can be improved. For example, the first AP uses the first GTK based on the identifier of the first AP in the first message. The second AP uses the first GTK based on the identifier of the second AP in the first message. The WLAN system also includes a third AP. The first message does not carry the identifier of the third AP. After receiving the first message, the third AP does not use the first GTK. The AC can also generate a second message. The second message carries the second GTK and the identifier of the third AP. The third AP uses the second GTK based on the identifier of the third AP. Therefore, by adding the AP identifiers, the reliability of multicast or broadcast can be improved.

[0009] In one alternative embodiment of the first aspect, the AC is further configured to send a first instruction to both the first AP and the second AP. The first AP is further configured to disable automatic GTK updates according to the first instruction. The second AP is further configured to disable automatic GTK updates according to the first instruction. When the AC is the first AP, the first AP does not need to send the first instruction to itself. The first AP sends the first instruction to the second AP. In this application, the first instruction prevents the first AP and the second AP from automatically updating the first GTK, thus avoiding a difference in the GTK between the first AP and the second AP. Therefore, this application can improve the reliability of multicast or broadcast.

[0010] In one alternative aspect of the first aspect, when a new AP connects to the AC, the AC is also used to send a first message to the new AP. When the AC is the first AP, the first AP is also used to send a first message to the new AP. Wherein, if the new AP uses the first GTK, the first AP can multicast or broadcast the first message to the STAs associated with the new AP. Therefore, this application can further improve the communication efficiency of multicast or broadcast.

[0011] In one alternative approach of the first aspect, the AC is also used to send the updated first GTK to the first AP and the second AP when any of the following conditions are met: AC restart, key timer in the AC times out, the encryption mode of the AC changes from public to encrypted, or the STA using the first GTK goes offline. Updating the first GTK can improve the security of multicast or broadcast.

[0012] In one alternative of the first aspect, the AC is also used to update the first GTK based on the updated GMK, the updated group random number and the MAC address of the AC, to obtain the updated first GTK.

[0013] In one alternative embodiment of the first aspect, the WLAN system further includes a third AP. The AC is also used to obtain packet reference information for the three APs. The three APs include a first AP, a second AP, and a third AP. The AC is also used to determine, based on the packet reference information, that the first AP and the second AP use a first GTK. The AC is also used to determine, based on the packet reference information, that the third AP uses a second GTK. The second GTK is different from the first GTK. In this case, the distance between the multiple APs in the WLAN system may be relatively large. The AC can group the multiple APs according to the packet reference information. APs within the same group use the same GTK, while APs in different groups use different GTKs. Therefore, this application can improve the security of multicast or broadcast while improving the communication efficiency of multicast or broadcast.

[0014] In one alternative approach of the first aspect, the AC is also used to send a second GTK to a third AP. Alternatively, the AC is also used to send a control instruction to the third AP. The third AP is used to generate a second GTK based on the control instruction. As described above, the AC can group multiple APs. For example, the first AP and the second AP belong to the first group. The third AP belongs to the second group. Different control centers can exist for different groups. For example, the control center for the first group can be the AC. The AC can be either the first AP or the second AP. The control center for the second group can be the third AP. The control center is used to generate and update the GTK within its group. Therefore, by assigning different control centers to different groups, the complexity of management can be reduced.

[0015] In one alternative approach of the first aspect, the grouping reference information includes channel quality information between APs, location information of STAs associated with the three APs, or on-demand information of the STAs associated with the three APs. The channel quality information between APs includes the channel quality information between any two of the three APs. The channel quality information between two APs characterizes the distance between the two APs to some extent. The distance between two APs characterizes the channel quality information between an STA associated with one AP and another AP to some extent. Therefore, grouping using channel quality information between APs or location information of STAs associated with the three APs can improve the communication quality of multicast or broadcast. When the on-demand information of multiple STAs is the same, the on-demand information can be multicast or broadcast to multiple STAs through one AP. Therefore, grouping using on-demand information can improve the communication efficiency of APs.

[0016] In one alternative embodiment of the first aspect, the second STA is further used to roam from the second AP to the first AP. The first AP is further used to encrypt data using the first GTK to obtain a second message, which is then multicast or broadcast. The second STA is further used to decrypt the second message according to the first GTK. Wherein, when the first AP and the second AP use different GTKs, after the second STA roams from the second AP to the first AP, the first AP may not be able to send its GTK to the second STA in a timely manner. Therefore, the second STA may not be able to properly decrypt the multicast or broadcast messages of the first AP. In this case, the second STA may exhibit abnormal behavior. For example, the second STA may disconnect from the first AP and reconnect with it. In this application, the first AP and the second AP use the same GTK. Therefore, even if the first AP does not send its GTK to the second STA in a timely manner, the second STA can still use the GTK sent by the second AP to decrypt the multicast or broadcast messages of the first AP. Therefore, this application can improve the reliability of multicast or broadcast.

[0017] In one alternative approach of the first aspect, the first AP and the second AP use the same Basic Service Set Identifier (BSSID). Some types of STAs may only receive multicast or broadcast messages from their associated APs based on the BSSID. If the BSSIDs of the first AP and the second AP are different, the second STA may discard the first message. By using the same BSSID, the second STA can normally receive multicast or broadcast messages from the first AP. In this case, the BSSID carried in the first message is the same as the BSSID of the second AP. Therefore, this application can improve compatibility with different types of STAs.

[0018] In one alternative approach of the first aspect, the first message is a multicast message. The destination IP address of the first message is the IP address of the first multicast group. When the first STA belongs to the first multicast group, the first STA processes the decrypted first message. When the first STA does not belong to the first multicast group, the first STA discards the decrypted first message. Different STAs associated with the same AP can belong to different multicast groups. Dividing multicast groups by IP address improves the flexibility of multicast. Similarly, when the second STA belongs to the first multicast group, the second STA processes the decrypted first message. When the second STA does not belong to the first multicast group, the second STA discards the decrypted first message.

[0019] In one alternative approach of the first aspect, the signal quality information between the second STA and the first AP is greater than a first threshold. As described above, this application can group APs in a WLAN system. In practical applications, the AC can also group STAs. For example, when the signal quality information between the second STA and the first AP is greater than the first threshold, the AC determines that the second STA belongs to the first multicast group. When the signal quality information between the second STA and the first AP is less than the first threshold, the AC determines that the second STA does not belong to the first multicast group. In this case, the second STA can receive multicast or broadcast messages from other APs. These other APs can be the second AP or the third AP, etc. In this application, by grouping STAs, the communication quality of multicast or broadcast communication can be improved while simultaneously increasing the efficiency of multicast or broadcast communication.

[0020] A second aspect of this application provides a wireless communication method. The wireless communication method includes the following steps: an AC generates a first GTK (Getting Things Done). The AC sends the first GTK to a first AP and a second AP. The first GTK is used by a first STA and a second STA to decrypt a first message multicast or broadcast by the first AP. The first AP and the first STA are associated. The second AP and the second STA are associated.

[0021] In one alternative approach of the second aspect, the AC generates the first GTK based on the GMK, a set of random numbers, and the MAC address of the AC.

[0022] In one alternative embodiment of the second aspect, the AC sends a first message to both the first AP and the second AP. The first message includes a first GTK. The first message also includes at least one of the following: identifiers of the first AP and the second AP, identifiers of VAPs in the first AP, identifiers of VAPs in the second AP, a key replay counter, a receive sequence counter, a group random number, or an integrity group temporary key.

[0023] In an alternative embodiment of the second aspect, the wireless communication method further includes the step of: the AC sending a first instruction to a first AP and a second AP. The first instruction is used by the first AP and the second AP to disable automatic updates of GTK according to the first instruction.

[0024] In an alternative embodiment of the second aspect, the wireless communication method further includes the step of: the AC sending an updated first GTK to the first AP and the second AP when any of the following conditions are met. The conditions include: AC restarting, key timer in the AC timing out, the AC's encryption mode changing from public to encrypted, and the STA using the first GTK going offline.

[0025] In an alternative approach of the second aspect, the wireless communication method further includes the following step: the AC updates the first GTK based on the updated GMK, the updated group random number, and the MAC address of the AC, to obtain the updated first GTK.

[0026] In an alternative embodiment of the second aspect, before the AC sends the first message to the first AP and the second AP, the wireless communication method further includes the following steps: the AC obtains packet reference information for three APs. The three APs include the first AP, the second AP, and the third AP. The AC determines, based on the packet reference information, that the first AP and the second AP use a first GTK. The AC determines, based on the packet reference information, that the third AP uses a second GTK. The second GTK is different from the first GTK.

[0027] In an alternative embodiment of the second aspect, after the AC determines that the third AP uses the second GTK based on the packet reference information, the wireless communication method further includes the following steps: the AC sends the second GTK to the third AP. Alternatively, the AC sends a control instruction to the third AP. The control instruction is used by the third AP to generate the second GTK according to the control instruction.

[0028] In one alternative approach of the second aspect, the group reference information includes channel quality information between APs, location information of STAs associated with the three APs, or on-demand information of STAs associated with the three APs. The channel quality information between APs includes channel quality information between any two of the three APs.

[0029] In an alternative approach of the second aspect, after the second STA roams from the second AP to the first AP, the first GTK is also used by the second STA to decrypt a second message multicast or broadcast by the first AP based on the first GTK. The first GTK is received by the second STA from the second AP.

[0030] In one alternative approach of the second aspect, the first AP and the second AP use the same BSSID.

[0031] In one alternative of the second aspect, the signal quality information between the second STA and the first AP is greater than a first threshold.

[0032] In an alternative approach to the second aspect, when a new AP connects to the AC, the wireless communication method further includes the step of the AC sending a first message to the new AP.

[0033] A third aspect of this application provides a wireless communication method. The wireless communication method includes the following steps: A first access point (AP) receives a first message from an access control (AC). The first message includes a first GTK (Getting Things Done) method. The first AP encrypts data using the first GTK to obtain a first message. The first AP multicasts or broadcasts the first message. The first AP sends the first GTK to a first STA (Single Targeting Device). The first GTK is used by the first STA to decrypt the first message. The first AP and the first STA are associated. The first AP and the second AP use the same first GTK. The first GTK is used by the second STA to decrypt the first message.

[0034] The second STA and the second AP are associated.

[0035] In one alternative of the third aspect, the first message further includes at least one of the following: identifiers of the first AP and the second AP, identifiers of the VAPs in the first AP, identifiers of the VAPs in the second AP, a key replay counter, a receive sequence counter, and a group random number or integrity group temporary key for generating the first GTK.

[0036] In an alternative embodiment of the third aspect, the wireless communication method further includes the following steps: the first AP receives a first instruction transmitted by the AC. The first AP disables automatic updates of the GTK according to the first instruction.

[0037] In an alternative embodiment of the third aspect, after the second STA roams from the second AP to the first AP, the wireless communication method further includes the following steps: the first AP encrypts data using a first GTK to obtain a second message. The first AP multicasts or broadcasts the second message. The first GTK is also used by the second STA to decrypt the second message based on the first GTK. The first GTK is received by the second STA from the second AP.

[0038] In one alternative approach of the third aspect, the first AP and the second AP use the same BSSID.

[0039] In one alternative approach of the third aspect, the signal quality information between the second STA and the first AP is greater than a first threshold.

[0040] A fourth aspect of this application provides a wireless communication method. The wireless communication method includes the following steps: A first AP generates a first GTK (Getting Things Done) encrypts data using the first GTK to obtain a first message. The first AP multicasts or broadcasts the first message. The first AP sends the first GTK to a second AP and a first STA (Single Aid Station). The first GTK is used by the first STA to decrypt the first message. The first AP and the first STA associate with each other. The first GTK is used by the second STA to decrypt the first message. The second STA and the second AP associate with each other.

[0041] In one alternative approach of the fourth aspect, the generation of the first GTK by the first AP includes: the first AP generating the first GTK based on the GMK, a set of random numbers and the MAC address of the first AP.

[0042] In one alternative of the fourth aspect, the first AP sends a first message to the second AP and the first STA. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the second AP, an identifier of the VAP in the second AP, a key replay counter, a receive sequence counter, and a group random number or integrity group temporary key for generating the first GTK.

[0043] In an alternative embodiment of the fourth aspect, the wireless communication method further includes the step of: the first AP sending a first instruction to the second AP. The first instruction is used by the second AP to disable automatic updates of GTK according to the first instruction.

[0044] In an alternative embodiment of the fourth aspect, after the second STA roams from the second AP to the first AP, the wireless communication method further includes the following steps: the first AP encrypts data using a first GTK to obtain a second message. The first AP multicasts or broadcasts the second message. The first GTK is also used by the second STA to decrypt the second message based on the first GTK. The first GTK is received by the second STA from the second AP.

[0045] In one alternative approach of the fourth aspect, the first AP and the second AP use the same BSSID.

[0046] In one alternative of the fourth aspect, the signal quality information between the second STA and the first AP is greater than a first threshold.

[0047] This application provides a wireless communication method in its fifth aspect. The wireless communication method includes the following steps: a second AP generates a first GTK (Getting Things Done); the second AP sends the first GTK to a first AP; the first GTK is used by the first AP to encrypt data and obtain a first message; the second AP sends the first GTK to a second STA (Single-Target Station); the first GTK is used by the second STA to decrypt the first message multicast or broadcast by the first AP; the second STA and the second AP are associated; the first GTK is used by the first STA to decrypt the first message multicast or broadcast by the first AP; and the first STA and the first AP are associated.

[0048] In one alternative approach of the fifth aspect, the second AP generating the first GTK includes: the second AP generating the first GTK based on the GMK, a set of random numbers, and the MAC address of the second AP.

[0049] In one alternative embodiment of the fifth aspect, the second AP sends a first message to the first AP. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the first AP, an identifier of a VAP in the first AP, a key replay counter, a receive sequence counter, and a group random number or integrity group temporary key for generating the first GTK.

[0050] In an alternative embodiment of the fifth aspect, the wireless communication method further includes the step of: the second AP sending a first instruction to the first AP. The first instruction is used by the first AP to disable automatic updates of GTK according to the first instruction.

[0051] In one alternative approach of the fifth aspect, the first AP and the second AP use the same BSSID.

[0052] A sixth aspect of this application provides a wireless communication apparatus. The wireless communication apparatus can be an AC (Acoustic Control Unit). The wireless communication apparatus includes a generation module and a transmission module. The generation module is used to generate a first GTK (Getting Things Done). The transmission module is used to send a first message to a first AP (Access Point) and a second AP (Access Point). The first message includes the first GTK. The first GTK is used by a first STA (Access Point) and a second STA (Access Point) to decrypt a first message multicast or broadcast by the first AP. The first AP and the first STA are associated. The second AP and the second STA are associated.

[0053] In one alternative embodiment of the sixth aspect, the generation module is used to generate a first GTK based on the GMK, a set of random numbers, and the MAC address of the wireless communication device.

[0054] In one alternative of the sixth aspect, the first message further includes at least one of the following: identifiers of the first AP and the second AP, identifiers of the virtual access point (VAP) in the first AP, identifiers of the VAP in the second AP, a key replay counter, a receive sequence counter, a group random number, or an integrity group temporary key.

[0055] In an alternative embodiment of the sixth aspect, the sending module is further configured to send a first instruction to both the first AP and the second AP. The first instruction is used by both the first AP and the second AP to disable automatic GTK updates.

[0056] In one alternative of the sixth aspect, the sending module is further configured to send an updated first GTK to the first AP and the second AP when any of the following conditions are met: the wireless communication device restarts, the key timer in the wireless communication device times out, the encryption mode of the wireless communication device changes from public to encrypted, or the STA using the first GTK goes offline.

[0057] In an alternative embodiment of the sixth aspect, the generating module is further configured to update the first GTK based on the updated GMK, the updated group random number, and the MAC address of the wireless communication device, to obtain the updated first GTK.

[0058] In an alternative embodiment of the sixth aspect, the wireless communication device further includes an acquisition module and a determination module. The acquisition module acquires packet reference information for three access points (APs), including a first AP, a second AP, and a third AP. The determination module determines, based on the packet reference information, that the first AP and the second AP use a first GTK. The determination module also determines, based on the packet reference information, that the third AP uses a second GTK. The second GTK differs from the first GTK.

[0059] In an alternative embodiment of the sixth aspect, the transmitting module is further configured to transmit the second GTK to the third AP. Alternatively, the transmitting module is further configured to transmit a control instruction to the third AP. The control instruction is used by the third AP to generate the second GTK based on the control instruction.

[0060] In one alternative approach of the sixth aspect, the group reference information includes channel quality information between APs, location information of STAs associated with the three APs, or on-demand information of STAs associated with the three APs. The channel quality information between APs includes channel quality information between any two of the three APs.

[0061] In one alternative embodiment of the sixth aspect, after the second STA roams from the second AP to the first AP, the first GTK is also used by the second STA to decrypt a second message multicast or broadcast by the first AP based on the first GTK. The first GTK is received by the second STA from the second AP.

[0062] In one alternative approach of the sixth aspect, the first AP and the second AP use the same BSSID.

[0063] In one alternative of the sixth aspect, the signal quality information between the second STA and the first AP is greater than a first threshold.

[0064] In one alternative of the sixth aspect, when a new AP is connected to the wireless communication device, the transmitting module is also used to send a first message to the new AP.

[0065] A seventh aspect of this application provides a wireless communication device. The wireless communication device may be a first access point (AP). The wireless communication device includes a receiving module, an encryption module, and a transmitting module. The receiving module is used to receive a first message from an access point (AC). The first message includes a first GTK (Getting Things Done) method. The encryption module is used to encrypt data using the first GTK to obtain a first message. The transmitting module is used to multicast or broadcast the first message. The transmitting module is also used to send the first GTK to a second AP and a first STA (Station). The first GTK is used by the first STA to decrypt the first message according to the first GTK. The wireless communication device and the first STA are associated. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA and the second AP are associated.

[0066] In one alternative of the seventh aspect, the first message further includes at least one of the following: identifiers of the first AP and the second AP, identifiers of the VAPs in the first AP, identifiers of the VAPs in the second AP, a key replay counter, a receive sequence counter, and a group random number or integrity group temporary key for generating the first GTK.

[0067] In an alternative embodiment of the seventh aspect, the wireless communication device further includes a shutdown module. The receiving module is also configured to receive a first instruction transmitted by the AC. The shutdown module is configured to disable automatic updates of the GTK according to the first instruction.

[0068] In one alternative embodiment of the seventh aspect, after the second STA roams from the second AP to the first AP, the encryption module is further used to encrypt data using the first GTK to obtain the second message. The sending module is further used to multicast or broadcast the second message. The first GTK is also used by the second STA to decrypt the second message based on the first GTK. The first GTK is received by the second STA from the second AP.

[0069] In one alternative of the seventh aspect, the wireless communication device and the second AP use the same BSSID.

[0070] In one alternative of the seventh aspect, the signal quality information between the second STA and the wireless communication device is greater than a first threshold.

[0071] This application provides an eighth aspect of a wireless communication apparatus. The wireless communication apparatus may be a first access point (AP). The wireless communication apparatus includes a generation module, an encryption module, and a transmission module. The generation module is used to generate a first GTK (Getting Things Done) method. The encryption module is used to encrypt data using the first GTK to obtain a first message. The transmission module is used to multicast or broadcast the first message. The transmission module is also used to send the first GTK to a second AP and a first STA (Station). The first GTK is used by the first STA to decrypt the first message based on the first GTK. The first AP and the first STA are associated. The first GTK is used by the second STA to decrypt the first message based on the first GTK. The second STA and the second AP are associated.

[0072] In one alternative of the eighth aspect, the generation module is used to generate the first GTK based on the GMK, a set of random numbers, and the MAC address of the first AP.

[0073] In an alternative embodiment of the eighth aspect, the sending module is configured to send a first message to the second AP and the first STA. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the second AP, an identifier of the VAP in the second AP, a key replay counter, a receive sequence counter, and a group random number or integrity group temporary key for generating the first GTK.

[0074] In an alternative embodiment of the eighth aspect, the sending module is further configured to send a first instruction to the second AP. The first instruction is used by the second AP to disable automatic GTK updates according to the first instruction.

[0075] In one alternative embodiment of the eighth aspect, after the second STA roams from the second AP to the first AP, the encryption module is further configured to encrypt data using a first GTK to obtain a second message. The sending module is further configured to multicast or broadcast the second message. The first GTK is also used by the second STA to decrypt the second message based on the first GTK. The first GTK is received by the second STA from the second AP.

[0076] In one alternative approach of the eighth aspect, the first AP and the second AP use the same BSSID.

[0077] In one alternative of the eighth aspect, the signal quality information between the second STA and the first AP is greater than a first threshold.

[0078] A ninth aspect of this application provides a wireless communication apparatus. The wireless communication apparatus may be a second access point (AP). The wireless communication apparatus includes a generation module and a transmission module. The generation module is used to generate a first GTK (Getting Things Done) method. The transmission module is used to send the first GTK to the first AP. The first GTK is used by the first AP to encrypt data and obtain a first message. The transmission module is also used to send the first GTK to a second STA (Single Targeting Station). The first GTK is used by the second STA to decrypt the first message multicast or broadcast by the first AP based on the first GTK. The second STA and the second AP are associated. The first GTK is used by the first STA to decrypt the first message multicast or broadcast by the first AP. The first STA and the first AP are associated.

[0079] In one alternative embodiment of the ninth aspect, the generation module is used to generate a first GTK based on the GMK, a set of random numbers, and the MAC address of the second AP.

[0080] In an alternative embodiment of the ninth aspect, the sending module is configured to send a first message to a first AP. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the first AP, an identifier of a VAP in the first AP, a key replay counter, a receive sequence counter, and a group of random numbers or an integrity group temporary key for generating the first GTK.

[0081] In an alternative embodiment of the ninth aspect, the sending module is further configured to send a first instruction to the first AP. The first instruction is used by the first AP to disable automatic GTK updates.

[0082] In one alternative approach of the ninth aspect, the first AP and the second AP use the same BSSID.

[0083] This application's tenth aspect provides an AC (Accelerator). The AC includes a processor and a transceiver. The processor is used to generate a first GTK (Getting Things Done). The transceiver is used to send a first message to a first AP (Access Point) and a second AP (Access Point). The first message includes the first GTK. The first GTK is used by a first STA (Station) and a second STA (Station) to decrypt a first message multicast or broadcast by the first AP. The first AP and the first STA are associated.

[0084] The second AP and the second STA are associated.

[0085] In one alternative embodiment of the tenth aspect, the processor generates a first GTK based on the GMK, a set of random numbers, and the MAC address of the wireless communication device.

[0086] In one alternative of the tenth aspect, the first message further includes at least one of the following: identifiers of the first AP and the second AP, identifiers of the virtual access point (VAP) in the first AP, identifiers of the VAP in the second AP, a key replay counter, a reception sequence counter, a group random number, or an integrity group temporary key.

[0087] In an alternative embodiment of the tenth aspect, the transceiver is further configured to send a first instruction to both the first AP and the second AP. The first instruction is used by both the first AP and the second AP to disable automatic GTK updates.

[0088] In one alternative of the tenth aspect, the transceiver is further configured to send an updated first GTK to the first AP and the second AP when any of the following conditions are met: the wireless communication device restarts, the key timer in the wireless communication device times out, the encryption mode of the wireless communication device changes from public to encrypted, or the STA using the first GTK goes offline.

[0089] In an alternative embodiment of the tenth aspect, the processor is further configured to update the first GTK based on the updated GMK, the updated group random number, and the MAC address of the wireless communication device, to obtain the updated first GTK.

[0090] In an alternative embodiment of the tenth aspect, the processor is further configured to acquire packet reference information for three APs. The three APs include a first AP, a second AP, and a third AP. The processor is further configured to determine, based on the packet reference information, that the first AP and the second AP use a first GTK. The processor is further configured to determine, based on the packet reference information, that the third AP uses a second GTK. The second GTK is different from the first GTK.

[0091] In an alternative embodiment of the tenth aspect, the transceiver is further configured to send a second GTK to a third AP. Alternatively, the transceiver is further configured to send a control instruction to the third AP. The control instruction is used by the third AP to generate a second GTK based on the control instruction.

[0092] In one alternative embodiment of the tenth aspect, the group reference information includes channel quality information between APs, location information of STAs associated with the three APs, or on-demand information of STAs associated with the three APs. The channel quality information between APs includes channel quality information between any two of the three APs.

[0093] In one alternative embodiment of the tenth aspect, after the second STA roams from the second AP to the first AP, the first GTK is also used by the second STA to decrypt a second message multicast or broadcast by the first AP based on the first GTK. The first GTK is received by the second STA from the second AP.

[0094] In one alternative approach of the tenth aspect, the first AP and the second AP use the same BSSID.

[0095] In one alternative of the tenth aspect, the signal quality information between the second STA and the first AP is greater than a first threshold.

[0096] In one alternative of the tenth aspect, when a new AP is connected to the wireless communication device, the transmitting module is also used to send a first message to the new AP.

[0097] The eleventh aspect of this application provides a first access point (AP). The first AP includes a processor and a transceiver. The transceiver is used to receive a first message from an access control (AC). The first message includes a first GTK (Getting Things Done) method. The processor is used to encrypt data using the first GTK to obtain a first message. The transceiver is used to multicast or broadcast the first message. The transceiver is also used to send the first GTK to a first STA (Station). The first GTK is used by the first STA to decrypt the first message according to the first GTK. The first AP and the first STA are associated; wherein the first AP and the second AP use the same first GTK. The first GTK is used by the second STA to decrypt the first message according to the first GTK. The second STA and the second AP are associated.

[0098] In one alternative of the eleventh aspect, the first message further includes at least one of the following: identifiers of the first AP and the second AP, identifiers of the VAPs in the first AP, identifiers of the VAPs in the second AP, a key replay counter, a receive sequence counter, and a group random number or integrity group temporary key for generating the first GTK.

[0099] In an alternative embodiment of the eleventh aspect, the transceiver is further configured to receive a first instruction transmitted by the AC. The processor is also configured to disable automatic updates of GTK based on the first instruction.

[0100] In one alternative embodiment of the eleventh aspect, after the second STA roams from the second AP to the first AP, the processor is further configured to encrypt data using the first GTK to obtain a second message. The transceiver is also configured to multicast or broadcast the second message. The first GTK is further configured for the second STA to decrypt the second message based on the first GTK. The first GTK is received by the second STA from the second AP.

[0101] In one alternative approach of the eleventh aspect, the first AP and the second AP use the same BSSID.

[0102] In one alternative of the eleventh aspect, the signal quality information between the second STA and the first AP is greater than a first threshold.

[0103] The twelfth aspect of this application provides a first access point (AP). The first AP includes a processor and a transceiver. The processor generates a first GTK (Getting Things Done) and encrypts data using the first GTK to obtain a first message. The transceiver is used for multicasting or broadcasting the first message. The transceiver is also used to send the first GTK to a second AP and a first STA (Station). The first GTK is used by the first STA to decrypt the first message. The first AP and the first STA are associated. The first GTK is used by the second STA to decrypt the first message. The second STA and the second AP are associated.

[0104] In one alternative embodiment of the twelfth aspect, the processor generates a first GTK based on the GMK, a set of random numbers, and the MAC address of the first AP.

[0105] In one alternative embodiment of the twelfth aspect, the transceiver is used to send a first message to the second AP and the first STA. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the second AP, an identifier of the VAP in the second AP, a key replay counter, a receive sequence counter, a group random number for generating the first GTK, or an integrity group temporary key.

[0106] In an alternative embodiment of the twelfth aspect, the transceiver is further configured to send a first instruction to the second AP. The first instruction is used by the second AP to disable automatic GTK updates according to the first instruction.

[0107] In one alternative embodiment of the twelfth aspect, after the second STA roams from the second AP to the first AP, the processor is further configured to encrypt data using a first GTK to obtain a second message. The transceiver is also configured to multicast or broadcast the second message. The first GTK is further configured for the second STA to decrypt the second message based on the first GTK. The first GTK is received by the second STA from the second AP.

[0108] In one alternative approach of the twelfth aspect, the first AP and the second AP use the same BSSID.

[0109] In one alternative of the twelfth aspect, the signal quality information between the second STA and the first AP is greater than a first threshold.

[0110] The thirteenth aspect of this application provides a second access point (AP). The second AP includes a processor and a transceiver. The processor generates a first GTK (Getting Things Done) and the transceiver sends the first GTK to the first AP. The first GTK is used by the first AP to encrypt data and obtain a first message. The transceiver is also used to send the first GTK to a second standby device (STA). The first GTK is used by the second STA to decrypt the first message multicast or broadcast by the first AP. The second STA and the second AP are associated. The first GTK is used by the first STA to decrypt the first message multicast or broadcast by the first AP. The first STA and the first AP are associated.

[0111] In one alternative embodiment of the thirteenth aspect, the processor generates the first GTK based on the GMK, a set of random numbers, and the MAC address of the second AP.

[0112] In one alternative embodiment of aspect thirteen, the transceiver is used to send a first message to a first AP. The first message includes a first GTK. The first message also includes at least one of the following: an identifier of the first AP, an identifier of a VAP in the first AP, a key replay counter, a receive sequence counter, and a group of random numbers or an integrity group temporary key for generating the first GTK.

[0113] In an alternative embodiment of aspect thirteen, the transceiver is further configured to send a first instruction to the first AP. The first instruction is used by the first AP to disable automatic GTK updates.

[0114] In one alternative approach of aspect thirteen, the first AP and the second AP use the same BSSID.

[0115] The fourteenth aspect of this application provides a computer storage medium storing instructions that, when executed on a computer, cause the computer to perform the method as described in the second aspect or any embodiment of the second aspect; or cause the computer to perform the method as described in the third aspect or any embodiment of the third aspect; or cause the computer to perform the method as described in the fourth aspect or any embodiment of the fourth aspect; or cause the computer to perform the method as described in the fifth aspect or any embodiment of the fifth aspect.

[0116] The fifteenth aspect of this application provides a computer program product that, when executed on a computer, causes the computer to perform the method as described in the second aspect or any embodiment of the second aspect; or causes the computer to perform the method as described in the third aspect or any embodiment of the third aspect; or causes the computer to perform the method as described in the fourth aspect or any embodiment of the fourth aspect; or causes the computer to perform the method as described in the fifth aspect or any embodiment of the fifth aspect. Attached Figure Description

[0117] Figure 1 This is a first structural schematic diagram of the WLAN system provided in the embodiments of this application;

[0118] Figure 2 This is a first flowchart illustrating the wireless communication method provided in the embodiments of this application;

[0119] Figure 3 This is a second flowchart illustrating the wireless communication method provided in the embodiments of this application;

[0120] Figure 4 This is a schematic diagram of the structure of the first message provided in the embodiments of this application;

[0121] Figure 5 This is a first flowchart illustrating the STA grouping method provided in the embodiments of this application;

[0122] Figure 6 This is a second flowchart illustrating the STA grouping method provided in the embodiments of this application;

[0123] Figure 7 This is a third flowchart illustrating the wireless communication method provided in the embodiments of this application;

[0124] Figure 8 This is a fourth flowchart illustrating the wireless communication method provided in the embodiments of this application;

[0125] Figure 9 This is a second structural diagram of the WLAN system provided in the embodiments of this application;

[0126] Figure 10 This is a first structural schematic diagram of the wireless communication device provided in the embodiments of this application;

[0127] Figure 11 This is a second structural schematic diagram of the wireless communication device provided in the embodiments of this application;

[0128] Figure 12 This is a schematic diagram of the structure of the wireless communication device provided in the embodiments of this application. Detailed Implementation

[0129] This application provides a WLAN system, wireless communication method, and apparatus. By using the same GTK, a first AP can multicast or broadcast a first message to a first STA and a second STA, thereby improving the multicast or broadcast communication efficiency of the first AP.

[0130] It should be understood that the terms "first," "second," etc., used in this application are for descriptive purposes only and should not be construed as indicating or implying relative importance, nor as indicating or implying order. Furthermore, for the sake of brevity and clarity, reference numerals and / or letters are repeated in several of the accompanying drawings. This repetition does not indicate a strict limiting relationship between the various embodiments and / or configurations. Exemplarily, features or content marked with dashed lines in the accompanying drawings can be understood as optional operations or optional structures in the embodiments.

[0131] The WLAN system described in this application is applied in the field of wireless communication. In wireless communication, to improve the coverage of wireless signals, multiple access points (APs) can be combined to form a WLAN system. In a WLAN system composed of multiple APs, each STA can only receive multicast or broadcast messages from the AP associated with it, resulting in low efficiency of AP multicast or broadcast communication.

[0132] Therefore, this application provides a WLAN system and a wireless communication method. Figure 1 This is the first structural diagram of the WLAN system provided in the embodiments of this application. Figure 1 As shown, the WLAN system includes a first AP 101 and a second AP 102. The first AP 101 is associated with a first STA 103. The second AP 102 is associated with a second STA 104. In practical applications, the WLAN system may also include an AC 105. The AC 105 is connected to the first AP 101 and the second AP 102 wirelessly or via a wired connection. Figure 1 On this basis, Figure 2 This is a schematic diagram of the first flowchart of the wireless communication method provided in the embodiments of this application. Figure 2 As shown, the wireless communication method includes the following steps.

[0133] In step 201, the first AP sends the first GTK to the first STA. The first AP 101 can generate the first GTK using the following formula: GTK = PRF(GMK + GNonce + MAC(AA)). Wherein, PRF is a pseudo-random function. Gnonce is a set of random numbers generated by the first AP 101. MAC(AA) is the BSSID of the first AP 101. GMK is generated by the first AP 101 based on the multicast session key (MSK). The first AP 101 can generate the MSK during pre-shared key (PSK) authentication. Alternatively, the first AP 101 can receive the first GTK from the second AP 102. When the WLAN system also includes AC 105, the first AP 101 can receive the first GTK from AC 105. Alternatively, the first AP 101 can receive information about generating the GTK from AC 105. The first AP 101 generates the first GTK based on the information about generating the GTK. The information used to generate the GTK may include a set of random numbers, the GMK, and the MAC address of AC 105. The first AP 101 and the first STA 103 are associated. After obtaining the first GTK, the first AP 101 sends the first GTK to the first STA 103.

[0134] In step 202, the second AP transmits the first GTK to the second STA. When the first AP 101 generates the first GTK, the second AP 102 can receive the first GTK from the first AP 101. Alternatively, the second AP 102 receives information from the first AP 101 regarding the generation of the first GTK. The second AP 102 generates the first GTK based on this information. Similarly, when the WLAN system also includes an AC 105, the second AP 102 can receive the first GTK or information regarding the generation of the GTK from the AC 105. The second AP acquires the same first GTK as the first AP. The first AP 101 is associated with the first STA 103. After acquiring the first GTK, the second AP 102 sends the first GTK to the second STA 104. It should be understood that there is no strictly defined timing relationship between steps 201 and 202.

[0135] In step 203, the first AP obtains the first message based on the first GTK encrypted data. The first message can be a multicast message or a broadcast message. When the first message is a multicast message, its destination MAC address can be a multicast MAC address. The multicast MAC address consists of six bytes. The least significant bit of the first byte is 1. The destination IP address of the first message can be a multicast Internet Protocol (IP) address. When the first message is a broadcast message, its destination MAC address can be a broadcast MAC address. The broadcast MAC address consists of six bytes. Each bit in the six bytes is 1. The broadcast IP address of the first message can be a broadcast IP address.

[0136] In step 204, the first AP multicasts or broadcasts the first message.

[0137] In step 205, the first STA decrypts the first packet using the first GTK. After receiving the first packet, the first STA 103 can read the destination MAC address in the first packet. When the destination MAC address in the first packet is a broadcast MAC address, the first STA 103 decrypts the first packet using the first GTK. When the destination MAC address in the first packet is a multicast MAC address, the first STA 103 determines whether it belongs to the multicast group corresponding to the multicast MAC address. When the first STA 103 belongs to the multicast group corresponding to the multicast MAC address, the first STA 103 decrypts the first packet using the first GTK. When the first STA 103 does not belong to the multicast group corresponding to the multicast MAC address, the first STA 103 can discard the first packet. After decrypting the first packet, the first STA 103 can obtain the destination IP address of the first packet. If the destination IP address in the first packet is a broadcast IP address, the first STA 103 can process the decrypted first packet. When the destination IP address in the first message is a multicast IP address, the first STA 103 determines whether it belongs to the multicast group corresponding to the multicast IP address. If the first STA 103 belongs to the multicast group corresponding to the multicast IP address, the first STA 103 can process the decrypted first message. If the first STA 103 does not belong to the multicast group corresponding to the multicast IP address, the first STA 103 can discard the decrypted first message.

[0138] In step 206, the second STA decrypts the first message according to the first GTK. A description of step 206 can be found in the description of step 205 above. It should be understood that there is no strictly defined timing relationship between steps 205 and 206.

[0139] In this application, the first AP 101 and the second AP 102 use the same GTK. Therefore, the first AP can multicast or broadcast the first message for the first STA and the second STA, thereby improving the communication efficiency of the first AP's multicast or broadcast.

[0140] In practical applications, a STA may roam between multiple APs in a WLAN system. For example, in Figure 2 In this scenario, the second STA 104 can roam from the second AP 102 to the first AP 101. After the second STA 104 roams to the first AP 101, the first AP 101 obtains the second message by encrypting the data using the first GTK. The first AP 101 then multicasts or broadcasts the second message. The second STA 104 can decrypt the second message based on the first GTK received from the second AP 102.

[0141] In practical applications, the first AP 101 and the second AP 102 can use the same BSSID. The second STA 104 can determine which first GTK to use to decrypt the first message based on the same BSSID. It should be understood that when the BSSIDs of the first AP 101 and the second AP 102 are different, the second AP 102 can send an instruction to the second STA 104. The instruction includes the BSSID of the first AP 101. The second STA 104 can determine which first GTK to use to decrypt the first message based on the instruction. It should be understood that when the second AP 102 has multiple VAPs, the first AP 101 can use the same BSSID with one of the multiple VAPs.

[0142] As described above, the first AP 101 and the second AP 102 can obtain the first GTK in various ways. In subsequent embodiments, the generation of the first GTK by AC 105 will be used as an example. It should be understood that in the following examples, the steps performed by AC 105 can be performed by either the first AP 101 or the second AP 102. Furthermore, when the first AP 101 or the second AP 102 performs the steps performed by AC 105, neither the first AP 101 nor the second AP 102 needs to perform any information interaction steps with itself. For example, in... Figure 2 In the process, when the first AP 101 generates the first GTK, the first AP 101 does not need to send the first GTK to the first AP 101.

[0143] The first AP 101 and the second AP 102 may have key timers configured. After the key timers expire, the first AP 101 and the second AP 102 can each update their first GTK. However, the updated first GTK of the first AP 101 and the updated first GTK of the second AP 102 may differ, causing the second STA 104 to be unable to properly decrypt multicast or broadcast messages from the first AP 101. Therefore, in this embodiment, the AC 105 can update the first GTK uniformly. Figure 3 This is a second flowchart illustrating the wireless communication method provided in the embodiments of this application. Figure 3 As shown, the wireless communication method includes the following steps.

[0144] In step 301, the AC sends a first instruction to the first AP and the second AP. This application embodiment does not limit the method or format in which the AC 105 sends the first instruction. The AC 105 can send the first instruction via unicast, multicast, or broadcast. The format of the first instruction can be agreed upon by the AC 105 and the APs.

[0145] In step 302, the first AP disables automatic GTK updates according to a first instruction. Upon receiving the first instruction, the first AP 101 can disable the key timer for updating the GTK. Alternatively, the first AP 101 can decouple the key timer timeout from GTK updates. That is, after the key timer times out, the first AP 101 does not update the GTK. It should be understood that when the first AP 101 includes multiple VAPs, the first AP 101 can disable automatic GTK updates only in the target VAP. The target VAP uses the first GTK. For example, the first AP 101 includes a first VAP and a second VAP. The first VAP uses the first GTK. The second VAP uses a third GTK. The first AP 101 can disable automatic GTK updates only in the first VAP. In this case, after the key timer times out, the first AP 101 can still update the GTK in the second VAP.

[0146] In step 303, the second AP disables GTK automatic updates according to the first instruction. For a description of step 303, please refer to the description in step 302 above. It should be understood that there is no strict timing constraint between steps 302 and 303.

[0147] In step 304, the AC sends a first GTK to the first AP and the second AP. The AC can generate the first GTK based on the GMK, a set of random numbers, and the MAC address of the AC105. After generating the first GTK, the AC 105 sends the first GTK to the first AP 101 and the second AP 102. The first GTK can be carried in a first message. This application embodiment does not limit the method or format of the AC 105 sending the first message. For example, Figure 4 This is a schematic diagram of the structure of the first message provided in the embodiments of this application. For example... Figure 4 As shown, the first message 401 includes a protocol version information field, a message type field, a message size field, an AP ID field, a VAP ID field, a GTK field, a key replay counter field, a receive sequence counter (RSC) field, a group nonce (Gnonce) field, an integrity group transient key (IGTK) field, and a reserved field.

[0148] The protocol version information field can be used to indicate that the first message is a GTK synchronization message. The message type field records the type of the first message, for example, the first message type is a control message. The message size field records the data size of the first message. The AP ID field records the identifier of the AP using the first GTK. For example, in this embodiment, the AP ID field includes the identifiers of the first AP 101 and the second AP 102. The VAP ID field records the identifier of the VAP using the first GTK. For example, the first VAP in the first AP 101 uses the first GTK. In this case, the VAP ID field includes the identifier of the first VAP. The GTK field records the first GTK. The key replay counter field records the sequence number of the first GTK. The sequence number of the first GTK is used to prevent attackers from launching attacks on the system by intercepting and replaying key exchange packets. The receive counter field carries an RSC value. The RSC value can be used to synchronize the replay status. The RSC value can announce the TKIP sequence counter (TSC) value of frames that have failed message integrity code (MIC) verification. The first AP 101 or the second AP 102 can identify the first message to be replayed based on the RSC value. The group random number field records the group random number used to generate the first GTK. The integrity group temporary key field carries verification information. The first AP 101 or the second AP 102 can verify the integrity of the first message based on the verification information. Reserved fields are also called reserved fields.

[0149] In step 305, AC updates the first GTK. AC 105 can update GMK to obtain the updated GMK. AC 105 can also update the group random number to obtain the updated group random number. AC 105 generates the updated first GTK based on the updated GMK, the updated group random number, and the MAC address of AC 105.

[0150] In step 306, the AC sends the updated first GTK to the first AP and the second AP. The AC 105 sends the updated first GTK to the first AP 101 and the second AP 102 when any one or more of the following conditions are met: AC 105 restarts, the key timer in the AC 105 times out, the encryption mode of the AC 105 changes from public to encrypted, or the STA using the first GTK goes offline. The AC 105 may have a key timer set up; after the key timer times out, the AC 105 sends the updated first GTK to the first AP 101 and the second AP 102. The STA using the first GTK can be a STA associated with either the first AP 101 or the second AP 102. For example, when the first STA 103 goes offline, the AC 105 sends the updated first GTK to the first AP 101 and the second AP 102.

[0151] It should be understood that the updated first GTK can be included in the updated first message. For a description of the first message, please refer to the preceding text. Figure 4 The relevant descriptions in the text are as follows. In the following descriptions, the description of GTK sent by one device to another can be referred to the description of the first message in the embodiments of this application.

[0152] It should be understood that, Figure 3 In this application, the embodiments are described using only the first AP 101 and the second AP 102 as examples. In practical applications, multiple APs in a WLAN system can use the same first GTK. Furthermore, when a new AP connects to AC 105, AC 105 can send the first GTK to the new AP.

[0153] In this embodiment, the first AP 101 can multicast or broadcast a first message to the second STA 104. Furthermore, the second STA 104 is not associated with the first AP 101. Therefore, the channel quality information between the second STA 104 and the first AP 101 will affect the communication quality of the multicast or broadcast. For this purpose, the AC 105 can group all STAs into N groups. The number of N groups corresponds one-to-one with the number of APs. All STAs include those associated with any one of the N APs. APs only multicast or broadcast to their corresponding STAs. The following description uses an example where N equals two, where the two APs include the first AP 101 and the second AP 102. For example... Figure 5 This is a first flowchart illustrating the STA packetization method provided in this application embodiment. Wireless communication methods may include STA packetization methods. For example... Figure 5 As shown, the STA grouping method includes the following steps.

[0154] In step 501, the AC obtains STA packet reference information from the first AP and the second AP. The STA packet reference information may include channel quality information between all STAs and N APs. For example, in Figure 5 In this diagram, N APs include AP 101 and AP 102. All STAs include STA 103, STA 104, and STA 102. STA 103 is associated with AP 101. STA 104, STA 104, STA 102, and AP 102 are associated with each other. STA packet reference information includes channel quality information between STA 103 and both AP 101 and AP 102. STA packet reference information also includes channel quality information between STA 104 and both AP 101 and AP 102. STA packet reference information also includes channel quality information between STA 104 and both AP 101 and AP 102. Channel quality information can be received signal strength indication (RSSI), interference duty cycle, or noise, etc.

[0155] In step 502, the AC groups all STAs according to the STA grouping reference information to obtain STA grouping information. AC 105 can group all STAs using different methods. For example, Figure 6 This is a second flowchart illustrating the STA grouping method provided in the embodiments of this application. Figure 6 As shown, the STA grouping method includes the following steps.

[0156] In step 5020, begin.

[0157] In step 5021, the AC sorts the N APs and designates the first AP as the current AP. For example, AC 105 can obtain load information or channel condition information from the first AP 101 and the second AP 102. AC 105 sorts the APs according to their load or channel condition. The load information may include the idle duty cycle. AC 105 can sort the APs in descending order of their idle duty cycles. For example, if the idle duty cycle of the first AP 101 is greater than that of the second AP 102, then the first AP 101 is sorted first. AC 105 designates the first AP 101 as the current AP.

[0158] In step 5022, the AC acquires the channel quality information of all STAs and the current AP. (As mentioned above...) Figure 5 In step 501, AC 105 acquires STA packet reference information. STA packet reference information includes channel quality information between all STAs and the current AP. The channel quality information between all STAs and the current AP includes channel quality information between the first AP 101 and the first STA 103, the second STA 104, and the third STA.

[0159] In step 5023, the AC establishes a mapping relationship between the current STA and the current AP, where the channel quality information of the current STA and the current AP is greater than a first threshold. Assume that the channel quality information between the first AP 101 and the first STA 103 and the second STA 104 is greater than the first threshold. The channel quality information between the first AP 101 and the third STA is less than or equal to the first threshold. At this time, the current STA includes the first STA 103 and the second STA 104. The first AP 101 corresponds to the first STA 103 and the second STA 104. The first STA 103 and the second STA 104 can also be referred to as the first multicast group.

[0160] In step 5024, AC determines whether to traverse N APs. The N APs include the second AP 102. Therefore, AC 105 determines that N APs have not been traversed. AC 105 executes step 5025.

[0161] In step 5025, the AC designates the next AP as the current AP. The AC designates the second AP 102 as the current AP.

[0162] In step 5026, the AC acquires the channel quality information of the remaining STAs and the current AP. (As mentioned above...) Figure 5 In step 501, AC 105 acquires STA packet reference information. STA packet reference information includes channel quality information for the remaining STAs and the current AP. The channel quality information for the remaining STAs and the current AP includes channel quality information for the second AP 102 and the third STA.

[0163] In step 5023, the AC establishes a mapping relationship between the current STA and the current AP, where the channel quality information of the current STA and the current AP is greater than a first threshold. Assume that the channel quality information between the second AP 102 and the third STA is greater than the first threshold. In this case, the current STA includes the third STA. The second AP 103 and the third STA correspond. The third STA can also be referred to as the second multicast group.

[0164] In step 5024, AC determines whether to traverse N APs. AC determines to traverse N APs. AC 105 executes step 5027.

[0165] In step 5027, the process ends.

[0166] In step 503, the AC sends STA packet information of the STA to the second AP. The STA packet information includes information about the first multicast group and information about the second multicast group. Wherein, according to the aforementioned... Figure 6 As described, the second STA 104 belongs to the first multicast group. The third STA belongs to the second multicast group. Multicast group information can include the multicast group's IP address or MAC address, etc. For example, the information for the first multicast group is its IP address, and the information for the second multicast group is its IP address.

[0167] In step 504, the second AP sends information about the first multicast group to the second STA.

[0168] In step 505, the second AP sends information about the second multicast group to the third STA. When the information about the first multicast group is the IP address of the first multicast group, and the information about the second multicast group is the IP address of the second multicast group, the second AP 102 also sends a first GTK to the third STA and the second STA 104. The third STA receives multicast or broadcast messages from the second AP 102. The third STA decrypts the multicast or broadcast messages according to the first GTK. The destination IP address of the multicast or broadcast messages is the IP address of the second multicast group. The third STA also processes the decrypted multicast or broadcast messages according to the IP address of the second multicast group. The second STA 104 receives multicast or broadcast messages from the first AP 101. The second STA 104 decrypts the multicast or broadcast messages according to the first GTK. The destination IP address of the multicast or broadcast messages is the IP address of the first multicast group. The second STA 104 also processes the decrypted multicast or broadcast messages according to the IP address of the first multicast group. After receiving a multicast or broadcast message from the second AP 102, the second STA 104 can decrypt the multicast or broadcast message. However, since the destination IP address of the multicast or broadcast message is the IP address of the second multicast group, the second STA 104 can discard the decrypted multicast or broadcast message. Similarly, after receiving a multicast or broadcast message from the first AP 101, the second STA 104 can also discard the decrypted multicast or broadcast message.

[0169] When the information of the first multicast group is the MAC address of the first multicast group, and the information of the second multicast group is the MAC address of the second multicast group, the destination MAC address of the multicast or broadcast message sent by the second AP 102 is the MAC address of the second multicast group. The third STA receives the multicast or broadcast message from the second AP 102. The third STA decrypts the multicast or broadcast message according to the first GTK. The destination MAC address of the multicast or broadcast message sent by the first AP 101 is the MAC address of the first multicast group. The second STA 104 receives the multicast or broadcast message from the first AP 101. The second STA 104 decrypts the multicast or broadcast message according to the first GTK. The third STA can discard the multicast or broadcast message sent by the first AP 101 according to the MAC address of the first multicast group. Similarly, the second STA 104 can discard the multicast or broadcast message sent by the second AP 102 according to the MAC address of the second multicast group.

[0170] In step 506, the AC sends STA packet information to the first AP. For a description of step 506, please refer to the description of step 503 above.

[0171] In step 507, the first AP sends information about the first multicast group to the first STA.

[0172] When the information for the first multicast group is the IP address of the first multicast group, the first AP 101 also sends the first GTK to the first STA 103. The first STA 103 receives multicast or broadcast messages from the first AP 101. The first STA 103 decrypts the multicast or broadcast messages according to the first GTK. The destination IP address of the multicast or broadcast message is the IP address of the first multicast group. The first STA 103 also processes the decrypted multicast or broadcast messages according to the IP address of the first multicast group. After receiving a multicast or broadcast message from the second AP 102, the first STA 103 can decrypt the multicast or broadcast message according to the first GTK. However, since the destination IP address of the multicast or broadcast message sent by the second AP 102 is the IP address of the second multicast group, the first STA 103 can discard the decrypted multicast or broadcast message.

[0173] When the information of the first multicast group is the MAC address of the first multicast group, the first AP 101 also sends the first GTK to the first STA 103. The first STA 103 receives multicast or broadcast messages from the first AP 101. The destination MAC address of the multicast or broadcast message is the MAC address of the first multicast group. The first STA 103 decrypts the multicast or broadcast message according to the first GTK. After the first STA 103 receives the multicast or broadcast message sent by the second AP 102, since the destination MAC address of the multicast or broadcast message sent by the second AP 102 is the MAC address of the second multicast group, the first STA 103 can discard the multicast or broadcast message sent by the second AP 102.

[0174] It should be understood that, Figure 5 In this process, there is no strictly defined temporal relationship between any two steps in steps 503 to 507. Figure 6 The grouping of STAs shown here is just an example. In practical applications, those skilled in the art can group STAs according to the actual situation.

[0175] For example, N APs include the first AP 101 and the second AP 102. All STAs include the first STA 103, the second STA 104, and the third STA. In step 502, AC 105 determines that the first STA 103, the second STA 104, and the third STA belong to the first multicast group based on the STA packet information. AC 105 determines that there are no STAs in the second multicast group based on the STA packet information. At this time, the second AP 102 does not need to send multicast or broadcast messages.

[0176] For example, N APs include a first AP 101, a second AP 102, and a third AP. All STAs include a first STA 103, a second STA 104, a third STA, and a fourth STA. The fourth STA is associated with the third AP. In step 502, AC 105 determines, based on STA packet information, that the first STA 103, the second STA 104, and the fourth STA belong to the first multicast group. The first multicast group corresponds to the first AP 101. AC 105 determines, based on STA packet information, that the third STA belongs to the second multicast group. The second multicast group corresponds to the second AP 102. AC 105 determines, based on STA packet information, that the third multicast group has no STAs. The third multicast group corresponds to the third AP. At this time, the first multicast group receives multicast or broadcast messages from the first AP 101. The second multicast group receives multicast or broadcast messages from the second AP 102. The third AP may not need to send multicast or broadcast messages.

[0177] In the preceding description, the first AP 101 and the second AP 102 used the same first GTK. In practical applications, the distance between multiple APs in a WLAN system may be relatively large. In this case, AC 105 can group multiple APs according to AP grouping reference information. AP grouping reference information is simply referred to as grouping reference information. APs within the same group use the same GTK, while APs in different groups use different GTKs. For example, Figure 7 This is a third flowchart illustrating the wireless communication method provided in this application embodiment. For example... Figure 7 As shown, the wireless communication method includes the following steps.

[0178] In step 701, the AC obtains packet reference information from the first AP, the second AP, and the third AP. The packet reference information may be channel quality information between the APs, location information of the STAs associated with the three APs, or on-demand information of the STAs associated with the three APs. The channel quality information between the APs includes the channel quality information between any two of the three APs. The three APs include the first AP 101, the second AP 102, and the third AP. The location information of the STAs associated with the three APs may include the location information of the first STA 103 and the second STA 104. The on-demand information of the STAs associated with the three APs may include the on-demand information of the first STA 103 and the second STA 104.

[0179] In step 702, the AC determines that the first AP and the second AP use the first GTK based on the packet reference information, and determines that the third AP uses the second GTK based on the packet reference information. The following description uses channel quality information between APs as an example. For instance, Table 1 is a channel quality information matrix between APs provided in this embodiment. As shown in Table 1, the channel quality information measured by the first AP 101 with the second AP 102 is -60. The channel quality information measured by the first AP 101 with the third AP is NA. Similarly, the channel quality information measured by the second AP 102 with the first AP 101 is -59. The channel quality information measured by the second AP 102 with the third AP is NA.

[0180]

[0181]

[0182] Table 1

[0183] In Table 1, a higher channel quality information value indicates better channel quality. NA indicates that the signal from the other end cannot be received. AC 105 classifies the first AP 101 and the second AP 102 as the first group according to Table 1. AC 105 classifies the third AP as the second group according to Table 1. APs in the first group use the first GTK. APs in the second group use the second GTK.

[0184] In step 703, the AC sends the first GTK to both the first and second APs. For a description of step 703, please refer to the foregoing. Figure 2 The description in steps 201 and 202 is as follows. After the first AP 101 and the second AP 102 receive the first GTK, the first AP 101 and the second AP 102 can decrypt the first message multicast or broadcast by the first AP 101 according to the first GTK.

[0185] In step 704, the AC sends the second GTK to the third AP. For a description of AC 105 generating the second GTK, please refer to the preceding text. Figure 2 The AC 105 generates the first GTK. The second GTK is different from the first GTK. After receiving the second GTK, the third AP can send the second GTK to the fourth STA. The fourth STA and the third AP are associated. The third AP can encrypt data based on the second GTK to obtain multicast or broadcast messages. The fourth STA can decrypt multicast or broadcast messages using the second GTK. It should be understood that the descriptions of the third AP and the fourth STA can be referenced to the aforementioned descriptions of the first AP and the first STA. For example, the AC 105 can also send a first instruction to the third AP. The third AP disables automatic GTK updates based on the first instruction.

[0186] In the foregoing Figure 7 In this configuration, AC 105 serves as the control center for both the first and second groups. The control center is responsible for maintaining the GTK (Gross Target Key) for its respective group. In practical applications, different groups of APs can have different control centers. For example, Figure 8 This is a fourth flowchart illustrating the wireless communication method provided in this application embodiment. Figure 8 As shown, the wireless communication method includes the following steps.

[0187] For a description of steps 701 to 703, please refer to the foregoing. Figure 7 The description in steps 701 to 703.

[0188] In step 801, the AC sends a control instruction to the third AP. This embodiment does not limit the method of sending the control instruction or its format. The format of the control instruction can be agreed upon by the third AP and AC 105.

[0189] In step 802, the third AP generates a second GTK according to the control instruction. Upon receiving the control instruction, the third AP becomes the control center of the second group. The third AP is responsible for maintaining the second GTK of the second group. For example, the third AP generates the second GTK according to the control instruction. The third AP can also send the second GTK to the fourth STA. The third AP can also update the second GTK according to the control instruction, obtaining the updated second GTK. The third AP then sends the updated second GTK to the fourth STA.

[0190] It should be understood that Figure 7 and Figure 8 This description uses only three access points (APs) as an example. In practical applications, the AC 105 can group multiple APs differently depending on the actual situation. For example, the WLAN system may also include a fourth AP. The AC 105 groups the third and fourth APs as a second group based on reference grouping information. In this case, Figure 8 In the process, the third AP can also send a second GTK to the fourth AP.

[0191] Figure 9 This is a second structural diagram of the WLAN system provided in the embodiments of this application. For example... Figure 9 As shown, the WLAN system includes a first AP 101, a second AP 102, a third AP 901, and a fourth AP 902. The circular dashed lines outside the APs represent their signal coverage areas. The dashed lines between the APs and STAs represent their association relationships. Specifically, the first AP 101 is associated with STA1 and STA3. The second AP 102 is associated with STA2. The third AP 901 is associated with STA4 and STA6. The fourth AP 902 is associated with STA5.

[0192] The solid arrow between the APs and STAs indicates the transmission direction of multicast or broadcast messages. AC 105 (not shown in the figure) groups the first AP 101 and the second AP 102 as the first group. In the first group, the first AP 101 uses the first GTK to encrypt data and obtain the first message. The first AP 101 multicasts or broadcasts the first message. STA1, STA2, and STA3 decrypt the first message according to the first GTK. AC 105 groups the third AP 901 and the fourth AP 902 as the second group. In the second group, the third AP 901 uses the second GTK to encrypt data and obtain the multicast or broadcast message. STA4, STA5, and STA6 decrypt the multicast or broadcast message sent by the third AP 901 according to the second GTK.

[0193] exist Figure 9 In this configuration, AC 105 can select a specific AP in the second group as the control center for that group. AC 105 can select the control center based on the processing capabilities of each AP in the second group, or the relationship between each AP in the second group and AC 105. For example, AC 105 might choose the AP with the highest processing capacity in the second group as the control center. Alternatively, AC 105 might choose the AP with the fewest nodes connected to AC 105. For instance, if the third AP 901 is directly connected to AC 105, and the fourth AP 902 is connected to AC 105 via the first AP 101, then AC 105 would choose the third AP 901 as the control center for the second group.

[0194] The wireless communication method and WLAN system provided in the embodiments of this application have been described above. The wireless communication device provided in the embodiments of this application is described below. Figure 10 This is a first structural schematic diagram of the wireless communication device provided in the embodiments of this application. For example... Figure 10 As shown, the wireless communication device 1000 includes a generation module 1001 and a transmission module 1002. The generation module 1001 generates a first GTK. The transmission module 1002 sends a first message to a first AP and a second AP. The first message includes the first GTK. The first GTK is used by a first station (STA) and a second STA to decrypt a first message multicast or broadcast by the first AP. The first AP and the first STA are associated. The second AP and the second STA are associated.

[0195] It should be understood that the wireless communication device 1000 can be AC ​​105 in the aforementioned wireless communication method or WLAN system. Therefore, for the description of the wireless communication device 1000, reference can be made to the relevant descriptions in the aforementioned wireless communication method or WLAN system. For example, the transmitting module 1002 can also be used to transmit a first instruction to the first AP. As another example, the transmitting module 1002 can also be used to transmit an updated first GTK to the first AP.

[0196] Figure 11 This is a second structural schematic diagram of the wireless communication device provided in the embodiments of this application. For example... Figure 11 As shown, the wireless communication device 1100 includes a generation module 1101, an encryption module 1102, and a transmission module 1103. The generation module 1101 generates a first GTK (Getting Things Done). The encryption module 1102 encrypts data using the first GTK to obtain a first message. The transmission module 1103 multicasts or broadcasts the first message. The transmission module 1103 also sends the first GTK to a second AP and a first STA. The first GTK is used by the first STA to decrypt the first message. The wireless communication device 1100 is associated with the first STA. The first GTK is used by the second STA to decrypt the first message. The second STA is associated with the second AP.

[0197] It should be understood that the wireless communication device 1100 may be the first AP 101 in the aforementioned wireless communication method or WLAN system. Therefore, the description of the wireless communication device 1100 can be referred to the relevant description in the aforementioned wireless communication method or WLAN system. For example, the encryption module 1102 may also be used to encrypt data according to the first GTK to obtain a second message. The sending module 1003 may also be used to multicast or broadcast the second message. As another example, the wireless communication device 1100 may also include a receiving module and a shutdown module. The receiving module is used to receive a first instruction from the AC. The shutdown module disables the automatic update of GTK according to the first instruction.

[0198] Figure 12 This is a schematic diagram of the structure of the wireless communication device provided in the embodiments of this application. Figure 12 As shown, the wireless communication device 1200 includes a processor 1201 and a transceiver 1202. The wireless communication device 1200 can be an AC or a first AP in a WLAN system or wireless communication method.

[0199] When the wireless communication device 1200 is AC, the processor 1201 generates a first GTK. The transceiver 1202 sends a first message to the first AP and the second AP. The first message includes the first GTK. The first GTK is used by the first STA and the second STA to decrypt the first message multicast or broadcast by the first AP. The first AP and the first STA are associated. The second AP and the second STA are associated.

[0200] It should be understood that the description of the wireless communication device 1200 can be found in the descriptions of the aforementioned wireless communication method or WLAN system. The processor 1201 can also be used to execute the processing steps performed by AC 105 in the aforementioned wireless communication method. For example, the processor 1201 can also be used to execute... Figure 3Step 305 in the process. For example, processor 1201 can also be used to execute... Figure 5 Step 502 in the above-mentioned wireless communication method. Transceiver 1202 can also be used to perform the transmitting or receiving steps performed by AC 105 in the aforementioned wireless communication method. For example, transceiver 1202 can also be used for... Figure 3 Step 301 in the process. For example, transceiver 1202 can also be used for... Figure 5 Steps 501 and 503 in the process.

[0201] When the wireless communication device 1200 is the first AP, the processor 1201 generates a first GTK (Getting Things Done). The processor 1201 encrypts data using the first GTK to obtain a first message. The transceiver 1202 multicasts or broadcasts the first message. The transceiver 1202 also sends the first GTK to the second AP and the first STA. The first GTK is used by the first STA to decrypt the first message. The first AP and the first STA are then associated. The first GTK is used by the second STA to decrypt the first message. The second STA and the second AP are then associated.

[0202] It should be understood that the description of the wireless communication device 1200 can be found in the aforementioned description of the wireless communication method or WLAN system. The processor 1201 can also be used to execute the processing steps performed by the first AP 101 in the aforementioned wireless communication method. For example, the processor 1201 can also be used to execute... Figure 3 Step 302 in the above-mentioned wireless communication method. The transceiver 1202 can also be used to perform the transmitting or receiving steps performed by the first AP 101 in the aforementioned wireless communication method. For example, the transceiver 1202 can also be used for... Figure 5 Step 504 in the process.

[0203] In other embodiments, the wireless communication device 1200 may also include a memory 1203. The memory 1203 may be non-volatile memory, such as a hard disk drive (HDD), or it may be volatile memory, such as random-access memory (RAM). The memory 1203 may be any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto.

[0204] The memory 1203 can be used to store the first GTK or the first message. The memory 1203 can also be used to store instructions so that the processor 1201 can perform the steps mentioned in the aforementioned wireless communication method. Alternatively, the memory 1203 can also be used to store other instructions to configure the parameters of the processor 1201 to achieve corresponding functions.

[0205] It should be understood that Figure 12 The device described above can also be used to perform the method steps mentioned in the aforementioned embodiments, variations or alternatives shown in the accompanying drawings, which will not be repeated here.

[0206] In this application embodiment, the processor 1201 can be a general-purpose processor, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in this application embodiment. The general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software units within the processor.

[0207] The program code executed by the processor 1201 to implement the above-described wireless communication method can be stored in the memory 1203. The memory 1203 and the processor 1201 are coupled. In this embodiment, the coupling is an indirect coupling or communication connection between devices, units, or modules, and can be electrical, mechanical, or other forms, used for information exchange between devices, units, or modules. The processor 1201 may operate in conjunction with the memory 1203.

[0208] Based on the above embodiments, this application also provides a computer-readable storage medium. This storage medium stores a software program, which, when read and executed by one or more processors, can implement the methods provided in any one or more of the above embodiments. The computer-readable storage medium may include various media capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory, random access memory, magnetic disk, or optical disk.

[0209] Based on the above embodiments, this application also provides a chip. The chip includes a processor for implementing the functions involved in any one or more of the above embodiments, such as acquiring or processing the first message involved in the above methods. Optionally, the chip further includes a memory for the program instructions and data necessary for the processor to execute. This chip can be composed of chips or can include chips and other discrete devices.

[0210] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0211] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0212] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0213] Obviously, those skilled in the art can make various modifications and variations to the embodiments of this application without departing from the scope of the embodiments of this application. Therefore, if these modifications and variations to the embodiments of this application fall within the scope of the claims of this application and their equivalents, this application also intends to include these modifications and variations.

Claims

1. A wireless local area network system for site roaming, characterized in that, It includes a controller, a first access point, and a second access point. The first access point is associated with a first site, and the second access point is associated with a second site. The first access point includes a first virtual access point (VAP) and a second VAP, wherein: The controller is used to generate a first set of temporary keys GTK and send a first message to the first access point and the second access point. The first message includes the first GTK, an access point identifier AP ID field and a virtual access point identifier VAP ID field. The AP ID field includes the identifier of the first access point and the identifier of the second access point, and the VAP ID field includes the identifier of the first VAP. The first access point is also used to disable automatic GTK updates in the first VAP; The first VAP in the first access point is used to obtain a first message by encrypting data with the first GTK, and then multicast or broadcast the first message. The first VAP in the first access point is used to send the first GTK to the first site, and the second access point is used to send the first GTK to the second site.

2. The wireless local area network system according to claim 1, characterized in that, The first message also includes at least one of the following: a group of random numbers and an integrity group temporary key.

3. The wireless local area network system according to claim 1, characterized in that, The controller is also configured to send a first instruction to the first access point and the second access point; The first access point is also configured to disable automatic GTK updates according to the first instruction; The second access point is also used to disable automatic updates of GTK according to the first instruction.

4. The wireless local area network system according to claim 1, characterized in that, When a new access point is connected to the controller, the controller is also used to send a first message to the new access point.

5. The wireless local area network system according to claim 1, characterized in that, The controller is used to generate the first GTK by: generating the first GTK based on the group master key GMK, the group random number, and the MAC address of the controller.

6. The wireless local area network system according to any one of claims 1 to 5, characterized in that, When any of the following conditions are met, the controller is further configured to send an updated first GTK to the first access point and the second access point; The conditions include: the controller restarts, the key timer in the controller times out, the encryption mode of the controller changes from public to encrypted, and the site using the first GTK goes offline.

7. The wireless local area network system according to claim 5, characterized in that, The controller is also configured to update the first GTK based on the updated GMK, the updated group random number, and the MAC address of the controller, to obtain the updated first GTK.

8. The wireless local area network system according to any one of claims 1 to 5, characterized in that, The wireless local area network system also includes a third access point; The controller is also configured to acquire packet reference information for three access points, the three access points including the first access point, the second access point, and the third access point; The controller is further configured to determine, based on the packet reference information, that the first access point and the second access point use the first GTK, and the third access point uses the second GTK, wherein the second GTK is different from the first GTK.

9. The wireless local area network system according to any one of claims 1 to 5, characterized in that, The second site is also used to roam from the second access point to the first access point; The first access point is also used to obtain a second message through the first GTK encrypted data, and to multicast or broadcast the second message; The second station is also used to decrypt the second message according to the first GTK.

10. The wireless local area network system according to any one of claims 1 to 5, characterized in that, The first GTK is used by the first site to decrypt the first message according to the first GTK.

11. The wireless local area network system according to claim 10, characterized in that, The first GTK is used by the second site to decrypt the first message according to the first GTK.

12. The wireless local area network system according to any one of claims 1 to 5, characterized in that, The controller is connected to the first access point and the second access point via a wired connection.

13. A communication method for site roaming, characterized in that, include: The controller generates the first set of temporary keys, GTK; The controller sends a first message to the first access point and the second access point. The first message carries a first GTK, an access point identifier AP ID field, and a virtual access point identifier VAP ID field. The AP ID field includes the identifier of the first access point and the identifier of the second access point, and the VAP ID field includes the identifier of the first VAP. The first access point includes a first virtual access point (VAP) and a second VAP. The first access point disables automatic updates of GTK in the first VAP. The first VAP encrypts data through the first GTK to obtain a first message and then multicasts or broadcasts the first message. The first VAP in the first access point sends the first GTK to the first site.

14. The method according to claim 13, characterized in that, The first message also includes at least one of the following: a key replay counter, a receive sequence counter, or an integrity group temporary key.

15. The method according to claim 13, characterized in that, The method further includes: The controller sends a first instruction to the first access point and the second access point, the first instruction being used by the first access point and the second access point to disable automatic GTK updates according to the first instruction.

16. The method according to claim 13, characterized in that, The method further includes the following when any one of the following conditions is met: The controller sends the updated first GTK to the first access point and the second access point; The conditions include: the controller restarts, the key timer in the controller times out, the encryption mode of the controller changes from public to encrypted, and the site using the first GTK goes offline.

17. The method according to claim 13, characterized in that, The controller generates the first GTK by: the controller generating the first GTK based on the group master key GMK, the group random number and the controller's MAC address.

18. The method according to any one of claims 13 to 17, characterized in that, Before the controller sends the first message to the first access point and the second access point, the method further includes: The controller acquires group reference information from three access points, including the first access point, the second access point, and the third access point. The controller determines, based on the packet reference information, whether the first access point and the second access point use the first GTK; The controller determines, based on the packet reference information, that the third access point uses a second GTK, which is different from the first GTK.

19. A communication device for site roaming, characterized in that, It includes a generation module and a sending module, wherein: The generation module is used to generate the first set of temporary keys GTK; The sending module is used to send a first message to a first access point and a second access point. The first message includes a first GTK, an access point identifier AP ID field, and a virtual access point identifier VAP ID field. The AP ID field includes the identifier of the first access point and the identifier of the second access point. The VAP ID field includes the identifier of the first VAP. The first access point includes a first virtual access point VAP and a second VAP. The first access point disables automatic GTK updates in the first VAP. The first VAP encrypts data using the first GTK to obtain a first message and multicasts or broadcasts the first message. The first VAP in the first access point sends the first GTK to the first site.

20. The apparatus according to claim 19, characterized in that, The first message also includes at least one of the following: a key replay counter, a receive sequence counter, or an integrity group temporary key.

21. The apparatus according to claim 19, characterized in that, The sending module is also used to send a first instruction to the first access point and the second access point, the first instruction being used by the first access point and the second access point to disable automatic GTK updates according to the first instruction.

22. The apparatus according to claim 19, characterized in that, The sending module is further configured to send an updated first GTK to the first access point and the second access point when any of the following conditions are met: the communication device restarts, the key timer in the communication device times out, the encryption mode of the communication device changes from public to encrypted, or the site using the first GTK goes offline.

23. The apparatus according to any one of claims 19-22, characterized in that, The generation module is used to generate a first GTK based on the GMK, a set of random numbers, and the MAC address of the communication device.

24. The apparatus according to any one of claims 19-23, characterized in that, The communication device is a controller.

25. A controller for site roaming, characterized in that, It includes a processor and a memory storing computer program instructions; the processor is coupled to the memory, and when the computer program instructions are executed by the processor, they implement the method as described in any one of claims 13-18.

Images