Communication method, communication device, sending end, receiving end, computer readable storage medium, computer program product

Abstract

Embodiments of the present application provide a communication method, a communication device, a sending end, a receiving end, a computer readable storage medium and a computer program product. The communication method comprises: sending an AMPDU, the AMPDU containing a plurality of control frames, each control frame having a security protection mechanism enabled and containing a respective packet sequence number (PN) value and a message integrity check (MIC); and the detection field of the MIC contains the PN value. The present application is beneficial to improving the communication quality.

Description

Technical Field

[0001] This application relates to the field of communication technology, specifically to a communication method, communication device, transmitting end, receiving end, computer-readable storage medium, and computer program product. Background Technology

[0002] In the 802.11 protocol, regarding frame security protection mechanisms, only data frames and management frames currently have security protection mechanisms, while control frames do not.

[0003] Currently, to maintain compatibility with existing devices, the integrity of management frames is protected only through Message Integrity Check (MIC) in control frames to prevent frame tampering or replay. This mechanism, which protects only frame integrity, is also used in the current 802.11 protocol for the security protection of broadcast management packets. Summary of the Invention

[0004] In view of this, embodiments of this application provide a communication method, a communication device, a transmitting end, a receiving end, a computer-readable storage medium, and a computer program product, which are beneficial to improving communication quality.

[0005] To achieve the above objectives, the embodiments of this application provide the following technical solutions.

[0006] In a first aspect, embodiments of this application provide a communication method, including: sending an AMPDU, wherein the AMPDU contains multiple control frames, each control frame has a security protection mechanism enabled, and includes its own packet sequence number PN value and message integrity detection MIC; wherein the detection field of the MIC includes the PN value.

[0007] Optionally, the multiple control frames include control frames of a first type and control frames of a second type, and the first type is different from the second type; wherein, the PN value space of the control frame of the first type is the same as or different from the PN value space of the control frame of the second type.

[0008] Optionally, the first type of control frame is a broadcast control frame, and the second type of control frame is a unicast control frame, and the PN value space of the broadcast control frame is different from that of the unicast control frame; the method satisfies one or more of the following: the PN values ​​of each broadcast control frame are taken from the PN value space of the broadcast control frame in ascending order; the PN values ​​of each unicast control frame are taken from the PN value space of the unicast control frame in ascending order.

[0009] Optionally, the control frame may also include a key identifier; wherein the key identifier of the first type of control frame is different from the key identifier of the second type of control frame.

[0010] Optionally, the PN value space of the first type of control frame is the same as that of the second type of control frame; the method satisfies one or more of the following: in the PN value space, each control frame is valued sequentially in ascending order of PN value; each control frame is placed in the AMPDU sequentially in ascending order of PN value; the MIC of each control frame is calculated independently based on its own PN value.

[0011] Optionally, multiple control frames may not contain the same type of trigger frame.

[0012] Optionally, multiple control frames may contain multiple trigger frames of the same type; the method satisfies one or more of the following: the multiple trigger frames of the same type have identical content; the content includes the PN value and the MIC value.

[0013] Optionally, multiple control frames may contain multiple trigger frames of the same type; the method satisfies one or more of the following: multiple trigger frames of the same type use the same PN value space; in the PN value space, values ​​are taken for each trigger frame of the same type in ascending order of PN value; each trigger frame of the same type is placed in the AMPDU in ascending order of PN value; the MIC of each trigger frame of the same type is calculated independently based on its respective PN value.

[0014] Optionally, the trigger frame type includes one or more of the following: broadcast trigger frame; unicast trigger frame.

[0015] Optionally, security protection mechanisms may include one or more of the following: protecting the integrity of control frames through the MIC; and protecting against replay attacks through the PN value.

[0016] Optionally, one or more of the following conditions must be met: in response to the control frame containing broadcast frames and / or multicast frames, the communication method is used for the AP; in response to the control frame containing only unicast frames, the communication method is used for the AP and / or STA.

[0017] Secondly, embodiments of this application provide a communication method, including: receiving an AMPDU, wherein the AMPDU contains multiple control frames, each control frame has a security protection mechanism enabled and contains its own packet sequence number PN value and message integrity detection MIC, the detection field of the MIC containing the PN value; and processing the control frames.

[0018] Optionally, the multiple control frames include control frames of a first type and control frames of a second type, and the first type is different from the second type; wherein, the PN value space of the control frame of the first type is the same as or different from the PN value space of the control frame of the second type.

[0019] Optionally, the first type of control frame is a broadcast control frame, and the second type of control frame is a unicast control frame, and the PN value space of the broadcast control frame is different from that of the unicast control frame; the control frame is processed to satisfy one or more of the following: in response to the received control frame being a broadcast control frame, a first replay count corresponding to the PN value space of the broadcast control frame is used for replay attack detection; in response to the received control frame being a unicast control frame, a second replay count corresponding to the PN value space of the unicast control frame is used for replay attack detection.

[0020] Optionally, the PN value space of the first type of control frame is the same as that of the second type of control frame, and the control frames are placed in the AMPDU in ascending order of PN value; the control frames are processed, including one or more of the following: processing the control frames in the order of reception in the AMPDU; and using a third replay counter corresponding to the PN value space for replay attack detection.

[0021] Optionally, multiple control frames may contain multiple trigger frames of the same type, and all content of the multiple trigger frames of the same type is identical; processing of control frames may include one or more of the following: processing multiple trigger frames of the same type in the order of reception in the AMPDU; after processing the first trigger frame, ignoring other identical trigger frames subsequently received in the same AMPDU.

[0022] Optionally, multiple control frames may contain multiple trigger frames of the same type, multiple trigger frames of the same type may use the same PN value space, and multiple trigger frames of the same type may be placed in the AMPDU in ascending order of PN value; the control frames may be processed in one or more of the following ways: processing multiple trigger frames of the same type in the order of reception in the AMPDU; and using a fourth replay counter corresponding to the same PN value space to detect replay attacks.

[0023] Thirdly, embodiments of this application provide a communication method, including: receiving first information from a peer device, the first information including one or more control frames; in response to the control frames meeting preset conditions, triggering a secure link (SA) query process with the peer device: wherein the preset conditions include one or more of the following: a security protection mechanism has been enabled; and no security information is contained.

[0024] Optional, security information includes a message integrity detection MIC.

[0025] Optionally, the control frame is a broadcast control frame, and the communication method is used by the STA; the preset conditions also include one or more of the following: the broadcast control frame is sent to the STA; the broadcast control frame carries information sent to the STA.

[0026] Optionally, the control frame is a unicast control frame, and the communication method is used for the AP and / or STA.

[0027] Fourthly, embodiments of this application provide a communication device, including: a first transmitting module, configured to transmit an AMPDU, wherein the AMPDU contains multiple control frames, each control frame has a security protection mechanism enabled, and includes its own packet sequence number PN value and message integrity detection MIC; wherein the detection field of the MIC includes the PN value.

[0028] Fifthly, embodiments of this application provide a communication device, comprising: a first receiving module for receiving an AMPDU, the AMPDU containing multiple control frames, each control frame having a security protection mechanism enabled and containing its own packet sequence number (PN) and message integrity detection (MIC), the detection field of the MIC containing the PN value; and a first processing module for processing the control frames.

[0029] Sixthly, embodiments of this application provide a communication device, including: a second receiving module, configured to receive first information from a peer device, the first information including one or more control frames; and a first triggering module, configured to trigger a secure link (SA) query process with the peer device in response to the control frames meeting preset conditions, wherein the preset conditions include one or more of the following: a security protection mechanism has been enabled; and no security information is included.

[0030] In a seventh aspect, embodiments of this application provide a transmitting end, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it executes the steps of the communication method provided in the first aspect.

[0031] Eighthly, embodiments of this application provide a receiving end, including a memory and a processor. The memory stores a computer program executable on the processor. When the processor runs the computer program, it performs the steps of the communication method provided in the second aspect, or performs the steps of the communication method provided in the third aspect.

[0032] Ninthly, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it causes the communication method provided in the first aspect, or the communication method provided in the second aspect, or the communication method provided in the third aspect to be executed. And / or, embodiments of this application provide a computer program product including a computer program / instruction that, when executed by a processor, implements the communication method provided in the first aspect, or implements the communication method in the second aspect, or implements the communication method in the third aspect.

[0033] In a tenth aspect, embodiments of this application also provide a chip (or communication device) storing a computer program, which, when executed by the chip, causes the communication method provided by the first, second, or third aspect to be executed.

[0034] In the eleventh aspect, embodiments of this application provide a chip module on which a computer program is stored. When the computer program is executed by the chip module, the communication method provided by the first aspect, the second aspect, or the third aspect is executed.

[0035] In a twelfth aspect, embodiments of this application provide a communication system, the communication system including means for performing the method provided in the first aspect, means for performing the method provided in the second aspect, and means for performing the method provided in the third aspect.

[0036] Compared with the prior art, the technical solution of the embodiments of the present invention has the following beneficial effects:

[0037] In this embodiment of the invention, each control frame in the transmitted AMPDU contains its own packet sequence number (PN) and message integrity detection (MIC). When receiving the AMPDU, since the detection field of the MIC contains the PN value, the MIC is used to perform integrity detection on the PN value. Based on the respective PN value and the detection status of the MIC, each control frame is subjected to tampering and replay detection. This helps to improve the anti-tampering and replay attack aspects of the protected control frame, thereby preventing misjudgments of tampering and replay attacks on control frames, reducing the probability of packet loss due to misjudgments, improving the accuracy of judging tampering and replay attacks on control frames, and ultimately improving communication quality. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1 This is a schematic diagram of the AMPDU frame structure in a communication method.

[0040] Figure 2 This is a flowchart of a communication method according to an embodiment of the present invention;

[0041] Figures 3 to 7 This is a schematic diagram of the AMPDU frame structure in a communication method according to an embodiment of the present invention;

[0042] Figure 8 This is a flowchart of another communication method in an embodiment of the present invention;

[0043] Figure 9 This is a flowchart of another communication method in an embodiment of the present invention;

[0044] Figure 10 This is a schematic diagram of the structure of a communication device according to an embodiment of the present invention;

[0045] Figure 11 This is a schematic diagram of the structure of another communication device in an embodiment of the present invention;

[0046] Figure 12 This is a schematic diagram of the structure of another communication device in an embodiment of the present invention;

[0047] Figure 13 This is a schematic diagram of the hardware structure of a communication device according to an embodiment of the present invention. Detailed Implementation

[0048] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0049] The communication systems applicable to the embodiments of this application include, but are not limited to, third-generation (3G), LTE, fourth-generation (4G), fifth-generation (5G), NR, and future evolution systems or multiple converged communication systems. The 5G system can be a non-standalone (NSA) 5G system or a standalone (SA) 5G system. The solutions of the embodiments of this invention can also be applied to various new communication systems in the future, such as 6G and 7G.

[0050] This application relates primarily to communication between wireless network technology (WIFI) devices.

[0051] The WIFI device can be a terminal device (or a terminal) that supports WIFI functionality. In this embodiment of the invention, the terminal can refer to various forms of user equipment (UE), access terminal, user unit, user station, mobile station, mobile station (MS), remote station, remote terminal, mobile device, user terminal, terminal equipment, wireless communication device, user agent, or user device that supports WIFI functionality. The terminal can also be a cellular phone, cordless phone, Session Initiation Protocol (SIP) phone, Wireless Local Loop (WLL) station, Personal Digital Assistant (PDA), handheld device with wireless communication functionality, computing device, or other processing device connected to a wireless modem, in-vehicle device, wearable device, a terminal in a future 5G network, or a terminal in a future evolved Public Land Mobile Network (PLMN), etc. This embodiment of the invention does not limit the scope of the terminal.

[0052] The peer device can be a network device that supports WIFI or a terminal device that supports WIFI.

[0053] The network device in this application embodiment can also be called an access network device, for example, it can be a base station (BS) (also called a base station device). A network device is a device deployed in a radio access network (RAN) to provide wireless communication functions. For example, in second-generation (2G) networks, equipment providing base station functionality includes base transceiver stations (BTS); in 3G networks, it includes Node Bs; in 4G networks, it includes evolved Node Bs (eNBs); in wireless local area networks (WLANs), it is an access point (AP); in NR, it includes next-generation node base stations (gNBs) and further evolved Node Bs (ng-eNBs). The gNB communicates with the terminal using NR technology, while the ng-eNB communicates with the terminal using evolved Universal Terrestrial Radio Access (E-UTRA) technology. Both gNBs and ng-eNBs can connect to the 5G core network. The network equipment in this application embodiment also includes equipment providing base station functionality in future new communication systems.

[0054] As mentioned earlier, the 802.11 MAC protocol involves the Medium Access Control Protocol Data Unit (MPDU). The corresponding aggregate packet format is AMPDU. Currently, improving communication quality is difficult; this paper analyzes the reasons for this difficulty in improving communication quality using a specific communication method.

[0055] Figure 1 This is a schematic diagram of the AMPDU frame structure in a communication method.

[0056] In the 802.11 protocol, prevention of replay attacks is mainly performed by maintaining a Packet Number (PN) between the sender and the receiver. Specifically, a new and strictly incrementing PN value is generated for each broadcast management packet. The receiver parses the received protected broadcast management packet, extracts the PN value, compares it with the locally maintained Replay Counter value, and detects whether the PN value is incrementing. If the PN value carried in the packet is not greater than the locally maintained Replay Counter value, the packet is discarded; if the PN value is greater than the locally maintained Replay Counter value, the local Replay Counter value is updated to the PN value, and the processing of this packet continues.

[0057] In the MPDU Aggregation defined in the 802.11 protocol, multiple control frames are allowed to be aggregated in the same aggregated packet (AMPDU, aggregated MPDU). Specifically, control frames of different subtypes can be aggregated in the same AMPDU under certain conditions; the Trigger frame, which is a subtype of control frame, can be duplicated multiple times in the same AMPDU, that is, multiple control frames with completely identical contents, so as to improve the reception success rate of the peer receiver.

[0058] However, aggregating multiple control frames in the same aggregated packet will cause the receiver to fail to make a correct judgment when performing replay detection. For example Figure 1 shows an AMPDU that aggregates two protected control frames, which includes MPDU1 containing the protected control frame and MPDU2 containing the protected control frame. MPDU1 contains a PN value of PN_x, and MPDU2 contains a PN value of PN_y. If the two protected control frames are different control frames and use the same set of Packet Number PN values and Replay Counter values, since the sender and the receiver cannot guarantee the processing order of the two control frames in the AMPDU, a situation may occur where PN_x < PN_y at the sender, but the receiver processes PN_y first, which will cause the receiver to treat the control frame containing PN_x as a replay attack frame and discard it. If the two protected control frames are identical control frames and PN_x is equal to PN_y, the receiver will make a misjudgment that a replay attack occurs, resulting in packet loss of control frames, thus affecting communication quality.

[0059] To solve the above technical problem, embodiments of the present application provide a communication method, with reference to Figure 2 , which shows a flowchart of a communication method according to an embodiment of the present invention.

[0060] In this embodiment, the communication method includes the following basic steps:

[0061] Step S1: Send AMPDU. AMPDU contains multiple control frames. Each control frame has a security protection mechanism enabled and contains its own packet sequence number (PN) and message integrity detection (MIC). The detection field of the MIC contains the PN value.

[0062] In this embodiment of the invention, each control frame in the transmitted AMPDU contains its own packet sequence number (PN) and message integrity detection (MIC). When receiving the AMPDU, since the detection field of the MIC contains the PN value, the MIC is used to perform integrity detection on the PN value. Based on the respective PN value and the detection status of the MIC, each control frame is subjected to tampering and replay detection. This helps to improve the anti-tampering and replay attack aspects of the protected control frame, thereby preventing misjudgments of tampering and replay attacks on control frames, reducing the probability of packet loss due to misjudgments, improving the accuracy of judging tampering and replay attacks on control frames, and ultimately improving communication quality.

[0063] To make the above-mentioned objectives, features and beneficial effects of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0064] Figures 3 to 7 This is a schematic diagram of the AMPDU frame structure in a communication method according to an embodiment of the present invention.

[0065] The communication method in this embodiment is suitable for the sending end.

[0066] Execution step S1: Send AMPDU. AMPDU contains multiple control frames. Each control frame has a security protection mechanism enabled and contains its own packet sequence number (PN) and message integrity detection (MIC). The detection field of the MIC contains the PN value.

[0067] AMPDU reduces the redundant transmission of frame headers, PLCP preambles, and PLCP headers required for each individual MPDU by aggregating multiple MPDUs into a larger frame for transmission, thus helping to reduce communication overhead.

[0068] Specifically, in the MPDU frame aggregation defined in the 802.11 protocol, multiple control frames are allowed to be aggregated in the same aggregation packet AMPDU.

[0069] Control frames are used to coordinate physical layer operations in wireless communication, such as Request to Send (RTS), Clear to Send (CTS), and Acknowledge (ACK).

[0070] In this embodiment, each control frame has a security protection mechanism enabled, which includes one or more of the following: protecting the integrity of the control frame through the MIC; and protecting against replay attacks through the PN value.

[0071] Specifically, the MIC value of each control frame is calculated based on the PN value. The corresponding PN value is filled into the control frame to be sent, and this PN value is protected by the MIC value corresponding to the control frame. That is, if the PN value is tampered with, the receiving end can detect the tampering by verifying the MIC value. When receiving an AMPDU, the PN value and MIC value of the received control frame are checked and verified with the PN value and MIC value of the control frame of the sent AMPDU. If they match, the current control frame is received. If the PN value does not match, it indicates that the current frame has been replayed and the current frame is discarded. If the MIC value does not match, it indicates that the current frame has been tampered with and the current frame is discarded.

[0072] As an example, in this embodiment, the received AMPDU control frame is parsed, the PN value is extracted, and compared with the locally maintained replay count value. It is then checked whether the PN value is increasing. If the PN value carried in the control frame is not greater than the locally maintained replay count, the current control frame is discarded. If the PN value is greater than the locally maintained replay count, the local replay count is updated to the PN value, and the current control frame is processed again.

[0073] In this embodiment, each control frame in the transmitted AMPDU contains its own packet sequence number (PN) and message integrity detection (MIC). Therefore, upon receiving the AMPDU, each control frame can be tampered with and replayed based on its PN and MIC detection status. This improves the protection against tampering and replay attacks in the protected control frames, thus preventing misjudgments of tampering and replay attacks, reducing the probability of packet loss due to misjudgments, and increasing the accuracy of tampering and replay attack detection, ultimately improving communication quality.

[0074] In this embodiment, the control frame also includes a key identifier (Key ID).

[0075] The key identifier represents the communication protection method used in the control frame.

[0076] In this embodiment, the communication method satisfies one or more of the following: in response to the control frame containing broadcast frames and / or multicast frames, the communication method is used for the AP; in response to the control frame containing only unicast frames, the communication method is used for the AP and / or STA.

[0077] When the control frame contains a broadcast frame and / or a multicast frame, this embodiment is applicable to communication or sensing scenarios in WIFI where the AP acts as the transmitter. The AP can support WLAN communication protocols, which can include protocols of the IEEE 802.11 series, such as the 802.11bn standard, and of course, also applicable to standards after 802.11bn.

[0078] When the control frame contains only unicast frames, this embodiment is applicable to scenarios where the AP and / or STA act as transmitters for communication or sensing in WIFI, and this embodiment is not limited thereto. Optionally, the AP can communicate or sense with a single STA, or the AP can communicate or sense with multiple STAs simultaneously. Specifically, communication or sensing between the AP and multiple STAs can be further divided into downlink transmission where the AP simultaneously sends signals to multiple STAs, and uplink transmission where multiple STAs send signals to the AP. The communication protocols between the AP and STA, between APs, or between STAs can support WLAN communication protocols, which may include protocols from the IEEE 802.11 series, such as those applicable to the 802.11bn standard, and also applicable to standards after 802.11bn.

[0079] An access point (AP) is a device with wireless communication capabilities that supports communication or sensing using WLAN protocols. It has the ability to communicate or sense other devices (such as stations or other access points) in a WLAN network, and can also communicate or sense other devices. Alternatively, an access point acts as a bridge connecting wired and wireless networks, primarily connecting various wireless network clients together and then connecting the wireless network to an Ethernet network. In a WLAN system, an access point can be called an access point station (AP STA). This wireless communication device can be a complete device or a chip or processing system installed within a complete device. Devices with these chips or processing systems can implement the methods and functions of the embodiments of this invention under the control of the chip or processing system. In the embodiments of this invention, the AP is a device that provides services to the STA and can support 802.11 series protocols or subsequent protocols. For example, an access point can be an access point for terminals (such as mobile phones) to enter a wired (or wireless) network, mainly deployed in homes, buildings, and parks, with a typical coverage radius of tens to hundreds of meters; it can also be deployed outdoors. For example, an AP can be a communication server, router, switch, bridge, or other communication entity; an AP can include various forms of macro base stations, micro base stations, relay stations, etc. Of course, an AP can also be the chip and processing system in these various forms of devices, thereby realizing the methods and functions of the embodiments of the present invention.

[0080] A station (STA) is a device with wireless communication capabilities, supporting communication or sensing using the WLAN protocol, and having the ability to communicate or sense other stations or access points in a WLAN network. In a WLAN system, a station can be called a non-access point station (non-AP STA). For example, an STA is any user communication device that allows a user to communicate or sense with an AP and thus communicate with the WLAN. This device with wireless communication capabilities can be a complete device, or it can be a chip or processing system installed in a complete device. Devices with these chips or processing systems can implement the methods and functions of the embodiments of the present invention under the control of the chip or processing system. For example, a station can be a wireless communication chip, a wireless sensor, or a wireless communication terminal, and can also be called a user. Furthermore, a station can be a mobile phone supporting Wi-Fi communication, a tablet computer supporting Wi-Fi communication, a set-top box supporting Wi-Fi communication, a smart TV supporting Wi-Fi communication, a smart wearable device supporting Wi-Fi communication, an in-vehicle communication device supporting Wi-Fi communication, and a computer supporting Wi-Fi communication, etc.

[0081] In this embodiment, the multiple control frames include a first type of control frame and a second type of control frame, and the first type is different from the second type.

[0082] That is, the AMPDU sent includes multiple different types of control frames.

[0083] As an example, in this embodiment, either the first type of control frame or the second type of control frame can be a broadcast control frame, and the other can be a unicast control frame.

[0084] Accordingly, in this embodiment, the key identifier of the first type of control frame is different from the key identifier of the second type of control frame.

[0085] Different types of control frames are protected using different key identifiers.

[0086] As an example, in this embodiment, broadcast control frames are protected using a broadcast key, and unicast control frames are protected using a unicast key.

[0087] In this embodiment, the PN value space of the first type of control frame may be the same as or different from the PN value space of the second type of control frame.

[0088] When generating the PN value for each control frame, each PN value is obtained from the PN value space. The PN value spaces for different types of control frames can be the same or different.

[0089] The following is a detailed description of an embodiment in which the PN value space of the first type of control frame differs from that of the second type of control frame.

[0090] In this embodiment, the first type of control frame is a broadcast control frame, the second type of control frame is a unicast control frame, and the PN value space of the broadcast control frame is different from that of the unicast control frame.

[0091] The PN value space for broadcast control frames differs from that for unicast control frames. At the transmitting end, the corresponding key identifier and PN value space are used depending on whether the transmitted protected control frame is a broadcast control frame or a unicast control frame. Similarly, at the receiving end, the corresponding PN value space is used for PN value detection depending on whether the received protected control frame is a broadcast control frame or a unicast control frame. Thus, the detection of PN values ​​between broadcast control frames and unicast control frames in the AMPDU is independent and does not affect each other, thereby reducing the probability of false positives in replay attacks and improving communication quality.

[0092] Specifically, in this embodiment, broadcast control frames and unicast control frames maintain and use their respective PN values. When a unicast control frame is sent, the PN value used corresponds to a value taken from the PN value space of the unicast control frame. When a unicast control frame is received, the replay count value maintained locally by the unicast control frame is used for detection. When a broadcast control frame is sent, the PN value used corresponds to a value taken from the PN value space of the broadcast control frame. When a broadcast control frame is received, the replay count value maintained locally by the broadcast control frame is used for detection.

[0093] In this embodiment, the values ​​of each broadcast control frame are taken from the PN value space in ascending order of the PN value.

[0094] Incrementing PN values ​​help ensure the uniqueness of each broadcast control frame. The receiver can determine whether the received broadcast control frames are duplicates by detecting the order of PN values, thus preventing attackers from interfering with communication by replaying old broadcast control frames. Incrementing PN values ​​also make it easier for the receiver to identify packet loss. For example, by detecting the PN value and jumping back to the PN value of a previously received packet, the receiver can determine that a packet has been sent repeatedly, thus suspecting a replay attack. It also helps avoid unnecessary processing of duplicate packets by the receiver, thereby improving communication efficiency.

[0095] In this embodiment, the PN values ​​of each unicast control frame are taken from the PN value space in ascending order of PN value.

[0096] Incrementing PN values ​​help ensure the uniqueness of each unicast control frame. The receiver can determine whether the received unicast control frames are duplicates by detecting the order of PN values, thus preventing attackers from interfering with communication by replaying old unicast control frames. Incrementing PN values ​​also make it easier for the receiver to identify packet loss. For example, by detecting the PN value and jumping back to the PN value of a previously received packet, the receiver can determine that a packet has been sent repeatedly, thus suspecting a replay attack. It also helps avoid unnecessary processing of duplicate packets by the receiver, thereby improving communication efficiency.

[0097] As an example, Figure 3 A schematic diagram of the frame structure of an AMPDU is shown. An AMPDU that aggregates multiple MPDUs includes a first protected broadcast control frame MPDU1 and a second protected unicast control frame MPDU2. MPDU1 uses a broadcast key with a PN value of PN_x, which is taken from the PN value space of the broadcast control frame in ascending order. MPDU2 uses a unicast key with a PN value of PN_y, which is taken from the PN value space of the unicast control frame in ascending order. PN_x and PN_y use different PN value spaces, and the size relationship between PN_x and PN_y does not affect each other.

[0098] The following is a detailed description of an embodiment in which the PN value space of the first type of control frame is the same as that of the second type of control frame.

[0099] In this embodiment, the PN value space of the first type of control frame can be the same as that of the second type of control frame. In a non-limiting embodiment, both can be 1 to 100, but with different values. For example, when the PN value of the first type of control frame is 10, the PN value of the second type of control frame can be 70.

[0100] The PN value space of the first type of control frame is the same as that of the second type of control frame. That is, different types of control frames in the AMPDU are all taken in the same PN value space, which saves value space and simplifies the value taking method.

[0101] In this embodiment, in the PN value space, the control frame is selected sequentially in ascending order of PN value.

[0102] Incrementing PN values ​​help ensure the uniqueness of each control frame. The receiver can determine whether the received control frames are duplicates by detecting the order of PN values, thus preventing attackers from interfering with communication by replaying old control frames. Incrementing PN values ​​also make it easier for the receiver to identify packet loss. For example, by detecting the PN value and jumping back to the PN value of a previously received packet, the receiver can determine that a packet has been sent repeatedly, thus suspecting a replay attack. It also helps avoid unnecessary processing of duplicate packets by the receiver, thereby improving communication efficiency.

[0103] In this embodiment, each control frame is placed in the AMPDU in ascending order of PN value.

[0104] When the receiving end receives the AMPDU, it processes each control frame sequentially according to the order in which the AMPDU is placed. When sending the AMPDU, the control frames are placed sequentially in the AMPDU according to the increasing order of the PN value. This allows the receiving end to process each control frame sequentially according to the increasing order of the PN value. This avoids the situation where the PN value of a later-processed control frame is lower than that of an earlier-processed control frame due to a mismatch between the processing order and the increasing order of the PN value, and the control frame is mistakenly judged as being under a replay attack and discarded. This helps to achieve a more accurate judgment of control frame replay attacks, thereby improving communication quality.

[0105] In this embodiment, the MIC of each control frame is calculated independently based on its own PN value.

[0106] The MIC of each control frame is calculated independently based on its own PN value. Different PN values ​​yield their respective MICs. Accordingly, when receiving AMPDU, the message integrity of each control frame can be detected based on its respective MIC.

[0107] As an example, Figure 4 A schematic diagram of the frame structure of an AMPDU is shown. An AMPDU that aggregates multiple MPDUs includes a first protected broadcast control frame MPDU1 and a second protected unicast control frame MPDU2. MPDU1 and MPDU2 are in the same PN value space in ascending order of PN value. The PN value of MPDU1 is PN_x and the PN value of MPDU2 is PN_x+1. MPDU1 and MPDU2 are placed in the AMPDU in ascending order of PN value.

[0108] Specifically, the same AMPDU carries two protected control frames of different types. The first control frame is a broadcast control frame, using a broadcast key; the second control frame is a unicast control frame, also using a broadcast key. Furthermore, the PN_x used in the first control frame is less than (PN_x+1) used in the second control frame.

[0109] In this embodiment, multiple control frames contain multiple trigger frames of the same type.

[0110] Specifically, in this embodiment, the type of trigger frame includes one or more of the following: broadcast trigger frame; unicast trigger frame, that is, multiple trigger frames can contain multiple broadcast trigger frames, and / or, multiple trigger frames can contain multiple unicast trigger frames.

[0111] In some embodiments, the trigger frames in the AMPDU are copied and must be of the same type.

[0112] In some embodiments, the trigger frames in the AMPDU must at least satisfy the following conditions: all of them must be broadcast trigger frames, or all of them must be unicast trigger frames.

[0113] In this embodiment, multiple trigger frames of the same type also include a key identifier; wherein, the key identifiers of multiple trigger frames of the same type are the same.

[0114] Multiple trigger frames of the same type use the same communication protection method.

[0115] The following is a detailed description of an embodiment in which multiple control frames contain multiple trigger frames of the same type.

[0116] In this embodiment, the contents of multiple trigger frames of the same type are identical.

[0117] Specifically, control frames can be copied multiple times within the same AMPDU, meaning that the AMPDU contains multiple trigger frames with identical content, which helps improve the reception success rate at the receiver.

[0118] In this embodiment, all contents include the PN value and the MIC value.

[0119] In other words, multiple trigger frames of the same type have the same PN value and the same MIC value. Accordingly, at the receiving end, after receiving a valid protected trigger frame, other protected trigger frames with the same PN and MIC values ​​received in the same AMPDU are ignored. This helps to ensure the reception of the control frame for this content and helps to prevent unnecessary repeated reception of trigger frames.

[0120] As an example, Figure 5 A schematic diagram of the frame structure of an AMPDU is shown. An AMPDU that aggregates multiple MPDUs includes a first protected broadcast trigger frame MPDU1 and a second protected broadcast trigger frame MPDU2. MPDU1 and MPDU2 use the same broadcast key and PN value, both of which are PN_x.

[0121] The following is a detailed description of another embodiment in which multiple control frames contain multiple trigger frames of the same type.

[0122] In this embodiment, multiple trigger frames of the same type use the same PN value space.

[0123] Multiple trigger frames of the same type share the same PN value space, meaning that multiple trigger frames of the same type in the AMPDU are all taken from the same PN value space, saving value space and simplifying the value taking method.

[0124] In this embodiment, in the PN value space, the values ​​of each trigger frame of the same type are taken in ascending order of PN value.

[0125] Incrementing PN values ​​help ensure the uniqueness of each trigger frame. The receiver can determine whether the received trigger frames are duplicates by detecting the order of PN values, thus preventing attackers from interfering with communication by replaying old trigger frames. Incrementing PN values ​​also make it easier for the receiver to identify packet loss. For example, by detecting the PN value and jumping back to the PN value of a previously received packet, the receiver can determine that a packet has been sent repeatedly, thus suspecting a replay attack. It also helps avoid unnecessary processing of duplicate packets by the receiver, thereby improving communication efficiency.

[0126] In this embodiment, trigger frames of the same type are placed in the AMPDU in ascending order of PN value.

[0127] When the receiving end receives the AMPDU, it processes each trigger frame sequentially according to the placement order in the AMPDU. When sending the AMPDU, the trigger frames are placed sequentially in the AMPDU according to the increasing PN value. This allows the receiving end to process each trigger frame sequentially according to the increasing PN value, thus avoiding the situation where the PN value of a later-processed trigger frame is less than that of an earlier-processed trigger frame due to a mismatch between the processing order and the increasing PN value order. This would lead to the misjudgment that the later-processed trigger frame has been subjected to a replay attack and thus be discarded. This is beneficial for achieving more accurate judgment of trigger frame replay attacks, thereby improving communication quality.

[0128] In this embodiment, the MIC of each trigger frame of the same type is calculated independently based on its respective PN value.

[0129] The MIC of each trigger frame is calculated independently based on its own PN value. Different PN values ​​yield their respective MICs. Accordingly, when receiving AMPDU, the message integrity of each trigger frame can be detected based on its respective MIC.

[0130] As an example, Figure 6A schematic diagram of the frame structure of an AMPDU is shown. An AMPDU that aggregates multiple MPDUs contains a first protected broadcast trigger frame MPDU1 and a second protected unicast trigger frame MPDU2. MPDU1 and MPDU2 use the same broadcast key but use different PN values. MPDU1 and MPDU2 are taken from the same PN value space in ascending order of PN value. The PN value of MPDU1 is PN_x and the PN value of MPDU2 is PN_x+1. MPDU1 and MPDU2 are placed in the AMPDU in ascending order of PN value.

[0131] It should be noted that the PN value can increase continuously or by a number of jumps.

[0132] In other embodiments, multiple control frames may be prohibited from containing the same type of trigger frame.

[0133] Multiple control frames are prohibited from containing the same type of trigger frame. This directly avoids the situation where the same type of trigger frame uses the same PN value, and packet loss occurs when receiving AMPDU due to misjudgment of the PN value being the same, thus improving communication quality.

[0134] It should be noted that the communication method in this embodiment can be a combination of various methods described in the foregoing embodiments. This is just one example. Figure 7 A schematic diagram of the frame structure of an AMPDU is shown. An AMPDU that aggregates multiple MPDUs includes a first protected broadcast control frame MPDU1, a second protected unicast trigger frame MPDU2, and a third protected unicast trigger frame MPDU3. Compared to the other two control frames MPDU2 and MPDU3, MPDU1 uses a different key and PN value space. The PN value of MPDU1 is PN_x. MPDU2 and MPDU3 use the same key and PN value space, and the PN values ​​of MPDU2 and MPDU3 are the same, both being PN_y.

[0135] Figure 8 This is a flowchart of another communication method in an embodiment of the present invention.

[0136] The communication method in this embodiment is suitable for the receiving end.

[0137] Execution step S81: Receive AMPDU. AMPDU contains multiple control frames. Each control frame has a security protection mechanism enabled and contains its own packet sequence number (PN) and message integrity detection (MIC). The detection field of the MIC contains the PN value.

[0138] Each MPDU transmission requires an ACK frame for confirmation. However, after an AMPDU transmission, the receiving end can use a block acknowledgment (Block ACK) to acknowledge multiple MPDUs, reducing the number of ACK frame transmissions and thus reducing communication overhead.

[0139] Control frames are used to coordinate physical layer operations in wireless communication, such as Request to Send (RTS), Clear to Send (CTS), and Acknowledge (ACK).

[0140] In this embodiment, each control frame has a security protection mechanism enabled, which includes one or more of the following: protecting the integrity of the control frame through the MIC; and protecting against replay attacks through the PN value.

[0141] Specifically, the MIC value of each control frame is calculated based on the PN value. The corresponding PN value is filled into the control frame to be sent, and this PN value is protected by the MIC value corresponding to the control frame. That is, if the PN value is tampered with, the receiving end can detect the tampering by verifying the MIC value. When receiving an AMPDU, the PN value and MIC value of the received control frame are checked and verified with the PN value and MIC value of the control frame of the sent AMPDU. If they match, the current control frame is received. If the PN value does not match, it indicates that the current frame has been replayed and the current frame is discarded. If the MIC value does not match, it indicates that the current frame has been tampered with and the current frame is discarded.

[0142] As an example, in this embodiment, the received AMPDU control frame is parsed, the PN value is extracted, and compared with the locally maintained replay count value. It is then checked whether the PN value is increasing. If the PN value carried in the control frame is not greater than the locally maintained replay count, the current control frame is discarded. If the PN value is greater than the locally maintained replay count, the local replay count is updated to the PN value, and the current control frame is processed again.

[0143] In this embodiment, each control frame in the transmitted AMPDU contains its own packet sequence number (PN) and message integrity detection (MIC). Therefore, upon receiving the AMPDU, each control frame can be tampered with and replayed based on its PN and MIC detection status. This improves the protection against tampering and replay attacks in the protected control frames, thus preventing misjudgments of tampering and replay attacks, reducing the probability of packet loss due to misjudgments, and increasing the accuracy of tampering and replay attack detection, ultimately improving communication quality.

[0144] In this embodiment, the control frame also includes a key identifier.

[0145] The key identifier represents the communication protection method used in the control frame.

[0146] In this embodiment, the communication method satisfies one or more of the following: in response to the control frame containing broadcast frames and / or multicast frames, the communication method is used for STA; in response to the control frame containing only unicast frames, the communication method is used for AP and / or STA.

[0147] When the control frame contains a broadcast frame and / or a multicast frame, this embodiment is applicable to communication or sensing scenarios in WIFI where the STA acts as the receiver. The STA can support WLAN communication protocols, which may include protocols of the IEEE 802.11 series, such as the 802.11bn standard, and of course, also applicable to standards after 802.11bn.

[0148] When the control frame contains only unicast frames, this embodiment is applicable to scenarios where the AP and / or STA in WIFI communicate or sense as receivers, and this embodiment of the invention is not limited thereto. Optionally, the AP can communicate or sense with a single STA, or the AP can communicate or sense with multiple STAs simultaneously. Specifically, communication or sensing between the AP and multiple STAs can be further divided into downlink transmission where the AP sends signals to multiple STAs simultaneously, and uplink transmission where multiple STAs send signals to the AP. The communication protocols between the AP and STA, between APs, or between STAs can support WLAN communication protocols, which may include protocols of the IEEE 802.11 series, such as those applicable to the 802.11bn standard, and of course, also applicable to standards after 802.11bn.

[0149] For detailed explanations of AP and STA, please refer to the foregoing embodiments, which will not be repeated here.

[0150] Step S82: Process the control frame.

[0151] The control frames are processed to detect the integrity of the current control frame and replay attacks.

[0152] In this embodiment, the multiple control frames include a first type of control frame and a second type of control frame, and the first type is different from the second type.

[0153] That is, the AMPDU sent includes multiple different types of control frames.

[0154] As an example, in this embodiment, either the first type of control frame or the second type of control frame can be a broadcast control frame, and the other can be a unicast control frame.

[0155] Accordingly, in this embodiment, the key identifier of the first type of control frame is different from the key identifier of the second type of control frame.

[0156] Different types of control frames are protected using different key identifiers.

[0157] As an example, in this embodiment, broadcast control frames are protected using a broadcast key, and unicast control frames are protected using a unicast key.

[0158] In this embodiment, the PN value space of the first type of control frame may be the same as or different from the PN value space of the second type of control frame.

[0159] When generating the PN value for each control frame, each PN value is obtained from the PN value space. The PN value spaces for different types of control frames can be the same or different.

[0160] The following is a detailed description of an embodiment in which the PN value space of the first type of control frame differs from that of the second type of control frame.

[0161] In this embodiment, the first type of control frame is a broadcast control frame, the second type of control frame is a unicast control frame, and the PN value space of the broadcast control frame is different from that of the unicast control frame.

[0162] The PN value space for broadcast control frames differs from that for unicast control frames. At the transmitting end, the corresponding key identifier and PN value space are used depending on whether the transmitted protected control frame is a broadcast control frame or a unicast control frame. Similarly, at the receiving end, the corresponding PN value space is used for PN value detection depending on whether the received protected control frame is a broadcast control frame or a unicast control frame. Thus, the detection of PN values ​​between broadcast control frames and unicast control frames in the AMPDU is independent and does not affect each other, thereby reducing the probability of false positives in replay attacks and improving communication quality.

[0163] In this embodiment, processing the control frame includes: in response to the received control frame being a broadcast control frame, using a first replay count corresponding to the PN value space of the broadcast control frame to perform replay attack detection.

[0164] When a broadcast control frame is sent, the PN value used corresponds to the PN value space of the broadcast control frame. The locally maintained first replay count corresponds to the PN value space. When a broadcast control frame is received, the locally maintained first replay count value corresponding to the broadcast control frame is used for detection.

[0165] Specifically, in this embodiment, replay attack detection includes: if the PN value is not greater than the first replay count value, packet loss processing is performed; if the PN value is greater than the first replay count value, the local first replay count value is updated to the PN value, and the current control frame is processed.

[0166] In this embodiment, processing the control frame includes: in response to the received control frame being a unicast control frame, using a second replay count corresponding to the PN value space of the unicast control frame to perform replay attack detection.

[0167] When a unicast control frame is sent, the PN value used corresponds to the PN value space of the unicast control frame. The locally maintained second replay count corresponds to the PN value space. When a unicast control frame is received, the locally maintained second replay count value corresponding to the unicast control frame is used for detection.

[0168] The following is a detailed description of an embodiment in which the PN value space of the first type of control frame is the same as that of the second type of control frame.

[0169] In this embodiment, the PN value space of the first type of control frame is the same as that of the second type of control frame, and the control frames are placed in the AMPDU in ascending order of PN value.

[0170] The PN value space of the first type of control frame is the same as that of the second type of control frame. That is, different types of control frames in the AMPDU are all taken in the same PN value space, which saves value space and simplifies the value taking method.

[0171] Incrementing PN values ​​help ensure the uniqueness of each control frame. The receiver can determine whether the received control frames are duplicates by detecting the order of PN values, thus preventing attackers from interfering with communication by replaying old control frames. Incrementing PN values ​​also make it easier for the receiver to identify packet loss. For example, by detecting the PN value and jumping back to the PN value of a previously received packet, the receiver can determine that a packet has been sent repeatedly, thus suspecting a replay attack. It also helps avoid unnecessary processing of duplicate packets by the receiver, thereby improving communication efficiency.

[0172] In this embodiment, processing the control frames includes processing them according to the receiving order in the AMPDU.

[0173] When the receiving end receives the AMPDU, it processes each control frame sequentially according to the placement order in the AMPDU. This ensures that the receiving end processes each control frame in ascending order of PN values. This avoids the situation where the PN value of a later-processed control frame is lower than that of an earlier-processed control frame due to a mismatch between the processing order and the ascending order of PN values. This prevents the later-processed control frame from being mistakenly judged as being under a replay attack and discarded. This facilitates a more accurate judgment of control frame replay attacks and thus improves communication quality.

[0174] In this embodiment, a third replay count corresponding to the PN value space is used for replay attack detection.

[0175] The locally maintained third replay count corresponds to the PN value space. When receiving a control frame, the locally maintained third replay count value corresponding to the control frame is used for detection.

[0176] In this embodiment, multiple control frames contain multiple trigger frames of the same type.

[0177] Specifically, in this embodiment, the type of trigger frame includes one or more of the following: broadcast trigger frame; unicast trigger frame, that is, multiple trigger frames can contain multiple broadcast trigger frames, and / or, multiple trigger frames can contain multiple unicast trigger frames.

[0178] In some embodiments, the trigger frames in the AMPDU are copied and must be of the same type.

[0179] In some embodiments, the trigger frames in the AMPDU must at least satisfy the following conditions: all of them must be broadcast trigger frames, or all of them must be unicast trigger frames.

[0180] In this embodiment, multiple trigger frames of the same type also include a key identifier; wherein, the key identifiers of multiple trigger frames of the same type are the same.

[0181] Multiple trigger frames of the same type use the same communication protection method.

[0182] The following is a detailed description of an embodiment in which multiple control frames contain multiple trigger frames of the same type.

[0183] In this embodiment, the contents of multiple trigger frames of the same type are identical.

[0184] Specifically, control frames can be copied multiple times within the same AMPDU, meaning that the AMPDU contains multiple trigger frames with identical content, which helps improve the reception success rate at the receiver.

[0185] In this embodiment, processing the control frame includes processing multiple trigger frames of the same type according to the receiving order in the AMPDU.

[0186] Process according to the receiving order in AMPDU to prevent misjudgment of PN value due to out-of-order processing.

[0187] In this embodiment, after processing the first trigger frame, other identical trigger frames received in the same AMPDU are ignored.

[0188] If multiple trigger frames of the same type have the same PN value and MIC value, then at the receiving end, after receiving a valid protected trigger frame, other protected trigger frames with the same PN and MIC values ​​received in the same AMPDU are ignored. This helps to ensure the reception of the trigger frame for that content and prevents unnecessary duplicate reception of trigger frames.

[0189] The following is a detailed description of another embodiment in which multiple control frames contain multiple trigger frames of the same type.

[0190] In this embodiment, multiple trigger frames of the same type use the same PN value space, and multiple trigger frames of the same type are placed in the AMPDU in ascending order of PN value.

[0191] Multiple trigger frames of the same type share the same PN value space, meaning that multiple trigger frames of the same type in the AMPDU are all taken from the same PN value space, saving value space and simplifying the value taking method.

[0192] Incrementing PN values ​​help ensure the uniqueness of each trigger frame. The receiver can determine whether the received trigger frames are duplicates by detecting the order of PN values, thus preventing attackers from interfering with communication by replaying old trigger frames. Incrementing PN values ​​also make it easier for the receiver to identify packet loss. For example, by detecting the PN value and jumping back to the PN value of a previously received packet, the receiver can determine that a packet has been sent repeatedly, thus suspecting a replay attack. It also helps avoid unnecessary processing of duplicate packets by the receiver, thereby improving communication efficiency.

[0193] In this embodiment, processing the control frame includes processing multiple trigger frames of the same type according to the receiving order in the AMPDU.

[0194] When the receiving end receives the AMPDU, it processes each trigger frame sequentially according to the placement order in the AMPDU. This ensures that the receiving end processes each trigger frame in ascending order of PN values. This avoids the situation where the PN value of a later-processed trigger frame is lower than that of an earlier-processed trigger frame due to a mismatch between the processing order and the ascending order of PN values. This prevents the later-processed trigger frame from being mistakenly judged as being under a replay attack and discarded. This facilitates a more accurate judgment of trigger frame replay attacks and thus improves communication quality.

[0195] In this embodiment, a fourth replay count corresponding to the same PN value space is used for replay attack detection.

[0196] The locally maintained fourth replay count corresponds to the same PN value space. When a trigger frame is received, the locally maintained fourth replay count value corresponding to the trigger frame is used for detection.

[0197] Figure 9 This is a flowchart of another communication method in an embodiment of the present invention.

[0198] The communication method in this embodiment is suitable for the receiving end.

[0199] Execution step S91: Receive first information from the peer device, the first information containing one or more control frames.

[0200] Receive the first information from the peer device to conduct normal communication.

[0201] As an example, in this embodiment, the control frame is a broadcast control frame, and the communication method is used by the STA. It can be a broadcast control frame sent by the AP as the transmitting end.

[0202] When the control frame is a broadcast control frame, this embodiment is applicable to communication or sensing scenarios in WIFI where the STA acts as the receiver. The STA can support WLAN communication protocols, which can include IEEE 802.11 series protocols, such as the 802.11bn standard, and of course, it is also applicable to standards after 802.11bn.

[0203] As an example, in this embodiment, the control frame is a unicast control frame, and the communication method is used by the AP and / or STA. It can be sent from the AP to the STA, or it can be sent from the STA to the AP.

[0204] When the control frame is a unicast control frame, this embodiment is applicable to scenarios where the AP and / or STA act as receivers for communication or sensing in WIFI, and this embodiment of the invention does not limit this. Optionally, the AP can communicate or sense with a single STA, or the AP can communicate or sense with multiple STAs simultaneously. Specifically, communication or sensing between the AP and multiple STAs can be further divided into downlink transmission where the AP simultaneously sends signals to multiple STAs, and uplink transmission where multiple STAs send signals to the AP. The communication protocols between the AP and STA, between APs, or between STAs can support WLAN communication protocols, which may include protocols from the IEEE 802.11 series, such as those applicable to the 802.11bn standard, and of course, also applicable to standards after 802.11bn.

[0205] For a detailed description of AP and STA, please refer to the foregoing embodiments, which will not be repeated here.

[0206] Execution step S92: In response to the control frame meeting the preset conditions, trigger the security link (SA) query process with the peer device.

[0207] When the control frame meets the preset conditions, it is necessary to trigger the SA query process to the peer device to query whether the security link (SA) with the peer device still exists.

[0208] In this embodiment, the preset conditions include one or more of the following: the security protection mechanism has been enabled; and no security information is contained.

[0209] When a security protection mechanism for control frames is enabled between two devices, meaning a security association (SA) is established between them, if a device receives a control frame that does not contain security information, the security protection mechanism is not satisfied. In this case, the device needs to trigger an SA query process with the peer device to check whether the security association (SA) with the peer device still exists.

[0210] In this embodiment, the security protection mechanism includes one or more of the following: protecting the integrity of the control frame through the MIC; and protecting against replay attacks through the PN value.

[0211] For a detailed explanation of the security protection mechanism, please refer to the foregoing embodiments, which will not be repeated here.

[0212] In some embodiments, the steps of enabling the security protection mechanism may include: interacting with the peer device to request an enablement, or sending an enablement request to the peer device; and enabling the security protection mechanism.

[0213] In some other embodiments, the step of enabling the security protection mechanism may include: enabling the security protection mechanism in response to receiving an enable request from the peer device; and sending an acknowledgment reply to the peer device.

[0214] In this embodiment, the security information includes the Message Integrity Check (MIC).

[0215] The Message Integrity Check (MIC) is used to detect the integrity of control frames.

[0216] In this embodiment, when the control frame is a broadcast control frame, the preset conditions also include one or more of the following: the broadcast control frame is sent to the STA; the broadcast control frame carries information sent to the STA.

[0217] Since broadcasting involves communication to multiple receivers, each receiver needs to confirm that the current broadcast control frame is specifically sent to it before proceeding with the Secure Link (SA) query process.

[0218] This invention also provides another communication method suitable for the sending end.

[0219] Step A: Send first information to the peer device. The first information contains one or more control frames.

[0220] Send the first message to the peer device to establish communication with the peer device.

[0221] In this embodiment, the first information is a Secure Link SA Query Request (SA Query Request) packet, which is used to establish a secure link with the peer device.

[0222] Step B: Receive the Secure Link SA Query Response packet sent by the peer device.

[0223] Specifically, if the peer device replies with a correct and condition-compliant secure link SA query response packet to the current device within a specified time, the current device considers that the secure link SA between the two devices still exists; otherwise, it considers that the secure link SA does not exist and needs to disconnect from the peer device.

[0224] Figure 10 This is a schematic diagram of the structure of a communication device according to an embodiment of the present invention.

[0225] refer to Figure 10 The communication device 50 includes: a first transmitting module 401, used to transmit AMPDU, the AMPDU containing multiple control frames, each control frame having a security protection mechanism enabled, and containing its own packet sequence number PN value and message integrity check MIC; wherein, the check field of the MIC contains the PN value.

[0226] about Figure 10 For more information on the working principle, operation method, and beneficial effects of the communication device shown, please refer to the preceding text and... Figures 2 to 7 The specific details will not be elaborated here.

[0227] Figure 11 This is a schematic diagram of the structure of another communication device in an embodiment of the present invention.

[0228] refer to Figure 11 The communication device 60 includes: a first receiving module 601, used to receive an AMPDU, the AMPDU containing multiple control frames, each control frame having a security protection mechanism enabled, and containing its own packet sequence number PN value and message integrity check MIC, the check field of the MIC containing the PN value; and a first processing module 602, used to process the control frames.

[0229] about Figure 11 For more information on the working principle, operation method, and beneficial effects of the communication device shown, please refer to the preceding text and... Figure 8 The specific details will not be elaborated here.

[0230] Figure 12 This is a schematic diagram of the structure of another communication device in an embodiment of the present invention.

[0231] refer to Figure 12 The communication device 70 includes: a second receiving module 701, used to receive first information from the peer device, the first information including one or more control frames; and a first triggering module 702, used to trigger a secure link SA query process with the peer device in response to the control frames meeting preset conditions, wherein the preset conditions include one or more of the following: a security protection mechanism has been enabled; and no security information is contained.

[0232] about Figure 12 For more information on the working principle, operation method, and beneficial effects of the communication device shown, please refer to the preceding text and... Figure 9 The specific details will not be elaborated here.

[0233] In practice, Figures 10 to 12 The communication device may correspond to a chip with communication function in a communication device; or to a communication device that includes a chip or chip module with communication function, or to a communication device.

[0234] This application also provides a transmitting end, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it executes the steps of the communication method described above.

[0235] This application also provides a receiving end, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor runs the computer program, it executes the steps of the communication method described above.

[0236] This application also provides a computer-readable storage medium storing a computer program thereon. When the computer program is run by a computer, the aforementioned communication method is executed. The storage medium may include read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk, etc. The storage medium may also include non-volatile memory or non-transitory memory, etc.

[0237] Figure 13 This is a schematic diagram of the hardware structure of a communication device according to an embodiment of this application.

[0238] The communication device can be a WIFI device, such as a STA or an AP.

[0239] Figure 13The terminal shown includes a memory 131, a processor 132, and a transceiver 133. The processor 132 is coupled to the memory 131 and the transceiver 133. The memory 131 can be located inside or outside the terminal. The memory 131, processor 132, and transceiver 133 can be connected via a communication bus. The transceiver 133 is used to communicate with other devices or communication networks.

[0240] Optionally, the transceiver 133 can be a transmitter. The memory 131 stores a computer program that can run on the processor 132, and when the processor 132 runs the computer program, the transceiver 133 performs the steps in the communication method provided in the above embodiments.

[0241] This application also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the above-described communication method.

[0242] It should be understood that in the embodiments of this application, the processor can be a central processing unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0243] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0244] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, a computer program can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means.

[0245] While the embodiments disclosed above are described in this application, this application is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of this application; therefore, the scope of protection of this application should be determined by the scope defined in the claims.

Claims

1. A communication method, characterized in that, include: Send an AMPDU, which contains multiple control frames. Each control frame has a security protection mechanism enabled and contains its own packet sequence number (PN) and message integrity detection (MIC). The detection field of the MIC includes the PN value.

2. The communication method according to claim 1, characterized in that, The plurality of control frames include a first type of control frame and a second type of control frame, wherein the first type is different from the second type; The PN value space of the first type of control frame may be the same as or different from the PN value space of the second type of control frame.

3. The communication method according to claim 2, characterized in that, The first type of control frame is a broadcast control frame, the second type of control frame is a unicast control frame, and the PN value space of the broadcast control frame is different from that of the unicast control frame. The method satisfies one or more of the following: The values ​​of each broadcast control frame are taken from the PN value space of the broadcast control frame in ascending order of PN value; Each unicast control frame takes a value from the PN value space of the unicast control frame in ascending order of PN value.

4. The communication method according to claim 2, characterized in that, The control frame also includes a key identifier; wherein the key identifier of the first type of control frame is different from the key identifier of the second type of control frame.

5. The communication method according to claim 2, characterized in that, The PN value space of the first type of control frame is the same as that of the second type of control frame; The method satisfies one or more of the following: In the PN value space, the values ​​of each control frame are taken sequentially in ascending order of PN values; The control frames are placed in the AMPDU in ascending order of PN value. The MIC of each control frame is calculated independently based on its own PN value.

6. The communication method according to claim 1, characterized in that, The multiple control frames are prohibited from containing the same type of trigger frame.

7. The communication method according to claim 1, characterized in that, The multiple control frames include multiple trigger frames of the same type; The method satisfies one or more of the following: The contents of multiple trigger frames of the same type are identical. The entire content includes the PN value and the MIC value.

8. The communication method according to claim 1, characterized in that, The multiple control frames include multiple trigger frames of the same type; The method satisfies one or more of the following: Multiple trigger frames of the same type use the same PN value space; In the PN value space, values ​​are taken for each trigger frame of the same type in ascending order of PN value; In order of increasing PN value, each trigger frame of the same type is placed in the AMPDU sequentially; The MIC of each trigger frame of the same type is calculated independently based on its respective PN value.

9. The communication method according to any one of claims 6 to 8, characterized in that, The type of the trigger frame includes one or more of the following: Broadcast trigger frame; Unicast trigger frame.

10. The communication method according to claim 1, characterized in that, The security protection mechanism includes one or more of the following: The integrity of the control frame is protected by the MIC; Protection against replay attacks is provided using the PN value.

11. The communication method according to claim 1, characterized in that, Meet one or more of the following: In response to the control frame containing a broadcast frame and / or a multicast frame, the communication method is used for an AP; In response to the control frame containing only unicast frames, the communication method is used for AP and / or STA.

12. A communication method, characterized in that, include: Receive AMPDU, which contains multiple control frames. Each control frame has a security protection mechanism enabled and contains its own packet sequence number (PN) and message integrity detection (MIC). The detection field of the MIC contains the PN value. The control frame is processed.

13. The communication method according to claim 12, characterized in that, The plurality of control frames include a first type of control frame and a second type of control frame, wherein the first type is different from the second type; The PN value space of the first type of control frame may be the same as or different from the PN value space of the second type of control frame.

14. The communication method according to claim 13, characterized in that, The first type of control frame is a broadcast control frame, the second type of control frame is a unicast control frame, and the PN value space of the broadcast control frame is different from that of the unicast control frame. The control frame is processed to satisfy one or more of the following: In response to the received control frame being a broadcast control frame, a first replay count corresponding to the PN value space of the broadcast control frame is used for replay attack detection. In response to the received control frame being a unicast control frame, a second replay count corresponding to the PN value space of the unicast control frame is used for replay attack detection.

15. The communication method according to claim 13, characterized in that, The PN value space of the first type of control frame is the same as that of the second type of control frame, and the control frames are placed in the AMPDU in ascending order of PN value; Processing the control frame includes one or more of the following: The control frames are processed according to the receiving order in the AMPDU; Replay attack detection is performed using a third replay count corresponding to the PN value space.

16. The communication method according to claim 12, characterized in that, The multiple control frames include multiple trigger frames of the same type, and all the contents of the multiple trigger frames of the same type are the same. Processing the control frame includes one or more of the following: Multiple trigger frames of the same type are processed according to the receiving order in the AMPDU; After processing the first trigger frame, ignore any other identical trigger frames received in the same AMPDU.

17. The communication method according to claim 12, characterized in that, The multiple control frames contain multiple trigger frames of the same type, the multiple trigger frames of the same type use the same PN value space, and the multiple trigger frames of the same type are placed in the AMPDU in ascending order of PN value; Processing the control frame includes one or more of the following: Multiple trigger frames of the same type are processed according to the receiving order in the AMPDU; Replay attack detection is performed using the fourth replay count corresponding to the same PN value space.

18. A communication method, characterized in that, include: Receive first information from the peer device, the first information containing one or more control frames; In response to the control frame meeting preset conditions, a secure link (SA) query process with the peer device is triggered: The preset conditions include one or more of the following: Security protection mechanisms have been activated. It does not contain security information.

19. The communication method according to claim 18, characterized in that, The security information includes a message integrity detection MIC.

20. The communication method according to claim 18, characterized in that, The control frame is a broadcast control frame, and the communication method is used by the STA; The preset conditions also include one or more of the following: The broadcast control frame is sent to the STA; The broadcast control frame carries information to be sent to the STA.

21. The communication method according to claim 18, characterized in that, The control frame is a unicast control frame, and the communication method is used for AP and / or STA.

22. A communication device, characterized in that, include: The first sending module is used to send AMPDU, which contains multiple control frames. Each control frame has a security protection mechanism enabled and contains its own packet sequence number (PN) and message integrity detection (MIC). The detection field of the MIC includes the PN value.

23. A communication device, characterized in that, include: The first receiving module is used to receive AMPDU, which contains multiple control frames. Each control frame has a security protection mechanism enabled and contains its own packet sequence number (PN) and message integrity detection (MIC). The detection field of the MIC contains the PN value. The first processing module is used to process the control frame.

24. A communication device, characterized in that, include: The second receiving module is configured to receive first information from the peer device, the first information including one or more control frames; The first triggering module is used to trigger a secure link (SA) query process with the peer device in response to the control frame meeting preset conditions. The preset conditions include one or more of the following: Security protection mechanisms have been activated. It does not contain security information.

25. A transmitting end, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor runs the computer program, it performs the steps of the communication method according to any one of claims 1 to 11.

26. A receiving end, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor runs the computer program, it performs the steps of the communication method according to any one of claims 12 to 17, or performs the steps of the communication method according to any one of claims 18 to 21.

27. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it causes the communication method according to any one of claims 1 to 11 to be executed, or causes the communication method according to any one of claims 12 to 17 to be executed, or causes the communication method according to any one of claims 18 to 21 to be executed; And / or, A computer program product, comprising a computer program / instructions, characterized in that, When executed by a processor, the computer program / instruction implements the steps of the communication method according to any one of claims 1 to 11, or the steps of the communication method according to any one of claims 12 to 17, or the steps of the communication method according to any one of claims 18 to 21.

Images