Seamless mobility domain (SMD) association frame protection method, storage medium, electronic device, and computer program product

Abstract

The embodiment of the application provides a seamless mobility domain (SMD) associated frame protection method, a storage medium, an electronic device and a computer program product, the method comprising: a seamless mobility domain management entity (SMD ME) generating SMD level key information through a pre-connection security negotiation (PASN) protocol and a non-access point, and performing associated frame interaction with the non-access point according to the SMD level key information. Through the embodiment of the application, the SMD level key information can be generated, the security communication between the SMD ME and the non-access point is enhanced, the associated frame is protected by using the SMD level key information, the safe seamless mobility domain association is realized, a more reliable and efficient network connection experience is provided for a user, and thus the problem that the associated frame between the non-AP and the SMD ME cannot be protected in the related art is solved.

Description

Technical Field

[0001] This application relates to the field of communications, and more specifically, to a method for protecting associated frames in a Seamless Mobility Domain (SMD), a storage medium, an electronic device, and a computer program product. Background Technology

[0002] Seamless roaming, a technology direction of Wi-Fi 8, is characterized by deploying access points (APs) within the same Seamless Mobility Domain (SMD) in different locations. Non-APs can communicate with the SMD through any AP without re-establishing associations, thus solving the latency problem that occurs during device roaming. Different APs within an SMD can share a single Media Access Control (MAC) Service Access Point (SAP), or they can each have their own MAC SAP. The MAC SAP communicates with the Seamless Mobility Domain Management Entity (SMD ME) through an internal interface. The SMD ME includes the Authenticator function from IEEE 802.1X. Terminal devices (Stations, STAs) logically establish a connection with the SMD ME within the SMD. The target AP for STA roaming may be a target AP within the SMD (i.e., intra-SMD roaming) or a target AP in a different SMD (i.e., cross-SMD roaming). When the STA roams within the SMD, the Pairwise Transient Key Security Association (PTKSA) remains unchanged.

[0003] Currently, the technical solutions related to SMD still have the following problems:

[0004] Question 1: When a non-AP associates with an SMD ME, the association frame cannot be protected. Currently, the protocol specification defined in IEEE 802.11bi only stipulates that a pairwise transient key (PTK) is generated between a non-AP and an AP using Preassociation Security Negotiation (PASN). However, this PTK can only be applied to the encryption and decryption process of association request / response frames between non-APs and APs, and cannot be applied to the protection of association frames between a non-AP and an SMD ME.

[0005] Question 2: Under the same SMD, for a non-AP in a mobile state, the PTK generated by PASN with the first AP cannot be applied to the encryption and decryption process of association request / response frames of the second AP. Currently, in the IEEE 802.11bi protocol specification, the generation of PTK and PTKSA using PASN between a non-AP and an AP is specific to the interaction between the two APs. For a mobile non-AP, it may complete the PASN process with AP1 at time T1 and generate PTK1 and PTKSA1. At time T2 (T2>T1), the non-AP may have moved out of AP1's coverage area and may send an association request frame to AP2. However, since PTK1 and PTKSA1 are generated through interaction between the non-AP and AP1, they are not applicable to the encryption and decryption process of association request / response frames between the non-AP and AP2.

[0006] There is no good solution to the above problems in the relevant technologies. Summary of the Invention

[0007] This application provides a method, storage medium, electronic device, and computer program product for protecting associated frames in a seamless mobile domain (SMD), to at least solve the problem in related technologies that it is impossible to protect associated frames between non-AP and SMD ME.

[0008] According to one embodiment of this application, a method for protecting associated frames in a Seamless Mobile Domain (SMD) is provided, applied to a Seamless Mobile Domain Management Entity (SMD ME). The method includes: generating SMD-level key information with a Non-Access Point (NA) through a Pre-Connection Security Negotiation (PASN) protocol; and interacting with the NA using associated frames based on the SMD-level key information.

[0009] According to another embodiment of this application, a method for protecting associated frames in a Seamless Mobile Domain (SMD) is provided, applied to a non-access point. The method includes: generating SMD-level key information with a Seamless Mobile Domain Management Entity (SMD ME) through a Pre-Connection Security Negotiation (PASN) protocol; and interacting with the SMD ME using associated frames based on the SMD-level key information.

[0010] According to yet another embodiment of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein the computer program, when executed by a processor, implements the steps in any of the above method embodiments.

[0011] According to yet another embodiment of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in any of the above method embodiments.

[0012] According to yet another embodiment of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0013] Through the above embodiments of this application, SMD-level key information can be generated during the PASN process, enhancing secure communication between the SMDME and the non-access point. By using SMD-level key information to protect associated frames, secure and seamless mobile domain association is achieved, providing users with a more reliable and efficient network connection experience. This solves the problem in related technologies that it is impossible to protect associated frames between non-AP and SMDME. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the architecture of multiple APs sharing a single MAC SAP within an SMD according to an embodiment of this application;

[0015] Figure 2 This is a schematic diagram of the architecture of each AP connected to a MAC SAP within the SMD according to an embodiment of this application;

[0016] Figure 3 This is a flowchart (I) of the associated frame protection of Seamless Mobile Domain SMD according to an embodiment of this application;

[0017] Figure 4 This is a flowchart (a) of the PASN process in one embodiment of this application;

[0018] Figure 5 This is a schematic diagram of the associated frame interaction process in one embodiment of this application (I);

[0019] Figure 6 This is a flowchart (II) of the associated frame protection of the Seamless Mobile Domain (SMD) according to an embodiment of this application;

[0020] Figure 7 This is a flowchart (II) of the PASN process in one embodiment of this application;

[0021] Figure 8 This is a schematic diagram (II) of the process of associated frame interaction in one embodiment of this application;

[0022] Figure 9 This is a schematic diagram of the SMD PASN and transmission associated frame protection in the embodiments of this application;

[0023] Figure 10 This is a schematic diagram of the extended format of the first SMD PASN authentication frame in an embodiment of this application;

[0024] Figure 11 This is a schematic diagram of the extended format of the second SMD PASN authentication frame in an embodiment of this application;

[0025] Figure 12 This is a schematic diagram of the extended format of the third SMD PASN authentication frame in the embodiments of this application;

[0026] Figure 13 This is a schematic diagram of the format of the SMD element field in the embodiments of this application. Detailed Implementation

[0027] The embodiments of this application will be described in detail below with reference to the accompanying drawings and examples.

[0028] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0029] The embodiments of this application can be run in Figure 1 or Figure 2 The network architecture shown.

[0030] Figure 1 This is a schematic diagram of the architecture of multiple APs sharing a single MAC SAP within an SMD according to an embodiment of this application, as shown below. Figure 1 As shown, AP1 and AP2 belong to SMD1 and share a MAC SAP, while AP3 and AP4 belong to SMD2 and share a MAC SAP. Non-APs can roam within an SMD or between SMDs. The MAC SAP communicates with the SMDME through an internal interface, and the SMDME includes the IEEE 802.1X Authenticator function.

[0031] Figure 2 This is a schematic diagram of the architecture of each AP connected to one MAC SAP within the SMD according to an embodiment of this application, as shown below. Figure 2 As shown, AP1 and AP2 belong to SMD1, and AP3 and AP4 belong to SMD2. Each AP has its own MAC SAP. Non-APs can roam within an SMD or between SMDs. The MAC-SAP communicates with the SMD ME through an internal interface. The SMD ME includes the IEEE 802.1X Authenticator function.

[0032] exist Figure 1 and Figure 2 In the architecture shown, non-AP and AP1 to AP4 are all multi-link devices (MLDs), supporting at least link 1 and link 2. However, this application is not limited to this; non-MLD devices can also be implemented. The non-AP can be a terminal device (STA).

[0033] In this embodiment, Figure 1 or Figure 2 Logically, all non-APs within a STA are connected to the SMD ME within the SMD. The target multi-link access point (AP MLD) for STA roaming may be a target AP within the SMD, or it may be a target AP in a different SMD. Non-APs in... Figure 1 When performing cross-SMD roaming under the architecture shown, a Distributed System (DS) matching and update event will be triggered. (non-AP in...) Figure 2 In the architecture shown, DS matching update events are triggered both during roaming within and across SMDs. Figure 1 or Figure 2 In the architecture shown, the Pairwise Transient Key Security Association (PTKSA) remains unchanged when a non-AP roams within the SMD.

[0034] This embodiment provides a method for protecting associated frames in a Seamless Mobile Domain (SMD) operating under the aforementioned network architecture. Specifically, it is applied to the Seamless Mobile Domain Management (SMD) ME. Figure 3 This is a flowchart (I) of the associated frame protection of Seamless Mobile Domain (SMD) according to an embodiment of this application, as follows: Figure 3 As shown, the process includes the following steps:

[0035] Step S302: Generate SMD-level key information with the non-access point through the pre-connection security negotiation PASN protocol;

[0036] Step S304: Interact with the non-access point using association frames based on the SMD-level key information.

[0037] The entity performing the above steps can be SMD ME.

[0038] Through the above steps, SMD-level key information can be generated during the PASN process, enhancing secure communication between the SMD ME and the non-access point (non-AP). By using SMD-level key information to protect associated frames, secure and seamless mobile domain association is achieved, providing users with a more reliable and efficient network connection experience. This solves the problem in related technologies that cannot protect associated frames between non-AP and SMD ME.

[0039] In this embodiment, SMD-level key information can be shared among various devices (such as SMD ME and multiple APs) within the entire SMD. That is, a non-AP can complete the PASN process with the SMD ME through any AP within a certain SMD to generate SMD-level key information. When a non-AP roams to another AP within the SMD, it does not need to perform the PASN process again and can directly use the already generated SMD-level key information.

[0040] Figure 4 This is a flowchart (I) of the PASN process in one embodiment of this application, as shown below. Figure 4 As shown, step S302 above, which is the SMD ME generating SMD-level key information with the non-access point through the pre-connection security negotiation PASN protocol, may include the following steps:

[0041] Step S3022: Receive the first PASN authentication frame from the non-access point through the first access point within the SMD;

[0042] Step S3024: Send a second PASN authentication frame to the non-access point through the first access point;

[0043] Step S3026: Receive a third PASN authentication frame from the non-access point through the first access point.

[0044] In this embodiment, at least one of the first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame carries SMD information. These three frames are used to implement an SMD-level PASN process between the SMD ME and the non-access point to generate the SMD-level key information. The first access point can be any access point within the SMD.

[0045] In some embodiments, the SMD information includes at least one of the following: the Media Access Control (MAC) address of the SMD ME, the identifier of the SMD ME, and the capability set of the SMD ME. The capability set of the SMD ME may include, but is not limited to, the SMD ME's security capabilities, frequency support, and Multi-Link Operation (MLO) capabilities. The use of this SMD information ensures correct identification and key generation between the SMD ME and non-access points, achieving both seamless WiFi switching within the SMD and ensuring network connection security.

[0046] In some embodiments, at least one of the first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame includes an SMD element field, wherein the SMD element field includes at least one of the following: an element ID field, a length field, an SMD ID field, an SMD MAC address field, a Robust Security Network Element (RSNE) field, and a Robust Security Network Extension Element (RSNXE) field.

[0047] In this embodiment, at least one of the first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame can carry or indicate SMD information through the SMD element field. The description of the SMD element field is shown in Table 1 below.

[0048] Table 1

[0049]

[0050] In this embodiment of the application, in addition to the newly added SMD element field, the other fields contained in the first PASN authentication frame, the second PASN authentication frame and the third PASN authentication frame can refer to the relevant provisions in the standard protocol IEEE 802.11az.

[0051] In some embodiments, the first access point is a single-link device or a multi-link device (MLD), and the first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame can be transmitted on the same link or different links of the first access point. Correspondingly, the non-AP can also be a single-link device or a multi-link device. Specific implementations of multi-link devices can refer to the Multi-Link Operation (MLO) technology in the IEEE 802.11be (Wi-Fi 7) protocol.

[0052] In some embodiments, the first PASN authentication frame further carries at least one Pairwise Master Key Identifier (PMKID), wherein the PMKID is used to indicate SMD-level key information pre-generated and stored by the non-access point and the SMD ME; and / or, the PMKID is generated based on the MAC address of the non-access point and the MAC address of the SMD ME.

[0053] In an exemplary embodiment, PMKID is generated by taking the MAC address of the non-AP MLD and the MAC address of the SMD ME as input parameters and according to the following algorithm: PMKID = Truncate-128(HMAC-SHA-1(PMK, "PMK Name"||AA ||SPA)); where AA is the SMD ME MAC address and SPA is the non-AP MLD MAC address.

[0054] In some embodiments, the method further includes: checking whether the PMKID matches pre-stored SMD-level key information; wherein, in response to the PMKID not matching the pre-stored SMD-level key information, the second PASN authentication frame further carries a status code indicating that the PMKID is invalid; or, in response to the PMKID matching the pre-stored SMD-level key information, the second PASN authentication frame further carries the PMKID selected by the SMD ME from the successfully matched PMKIDs.

[0055] In some embodiments, the SMD-level key information includes at least one of the following: an SMD-level pairwise master key (PMK), an SMD-level pairwise transient key (PTK), a pairwise transient key security association (PTKSA), and a pairwise master key security association (PMKSA).

[0056] In an exemplary embodiment, the PTK is composed of a key confirmation key (KCK), a key encryption key (KEK), and a temporary key (TK). Optionally, the PTK may also include a key derivation key (KDK). The encryption / decryption key for the associated frames of the interaction between the non-access point and the SMD-ME is TK.

[0057] In one exemplary embodiment, the SMD-level PMK and / or the SMD-level PTK are generated based on the MAC address of the non-access point and the MAC address of the SMD ME.

[0058] Figure 5 This is a schematic diagram (a) of the associated frame interaction in one embodiment of this application, as shown below. Figure 5 As shown, step S304 above, which is to perform association frame interaction with the non-access point based on the SMD-level key information, may include the following steps:

[0059] Step S3042: Receive the first associated frame from the non-access point through the second access point within the SMD;

[0060] Step S3044: Send a second association frame to the non-access point through the second access point;

[0061] The second access point is any one of the access points within the SMD. Both the first and second association frames carry SMD information. The first and second association frames are encrypted and decrypted based on the SMD-level key information or the key information between the non-access point and the second access point. The first and second association frames are used to establish an SMD-level connection between the SMD ME and the non-access point.

[0062] In some embodiments, the first AP and the second AP can be the same AP or different APs within the SMD.

[0063] In some embodiments, at least one of the following is included:

[0064] 1) The first associated frame is encrypted by the non-access point according to the SMD-level key information, and decrypted by the SMD ME according to the SMD-level key information;

[0065] 2) The second associated frame is encrypted by the SMD ME according to the SMD-level key information, and decrypted by the non-access point according to the SMD-level key information;

[0066] 3) The first associated frame is encrypted by the non-access point according to the SMD-level key information or the key information between the non-access point and the second access point, and is decrypted by the second access point according to the SMD-level key information or the key information between the non-access point and the second access point;

[0067] 4) The second associated frame is encrypted by the SMD ME according to the SMD-level key information or the key information between the non-access point and the second access point, and is decrypted by the second access point according to the SMD-level key information or the key information between the non-access point and the second access point.

[0068] In some embodiments, the key information between the non-access point and the second access point is generated based on the SMD-level key information and the identifier information of the second access point, wherein the identifier information of the second access point includes the MAC address of the second access point and / or other identifier information of the second access point.

[0069] In some embodiments, the first associated frame and the second associated frame are encrypted and decrypted based on the SMD-level key information and Additional Associated Data (AAD) information, wherein the AAD information includes at least one of the following: the MAC address of the SMD ME, the MAC address of the second access point, the MAC address of the non-access point, the Transmitter Address (TA), and the Receiver Address (RA).

[0070] In some embodiments, the first association frame is an association request frame and the second association frame is an association response frame; or, the first association frame is a reassociation request frame and the second association frame is a reassociation response frame; or, the first association frame is a multi-link reconfiguration request frame and the second association frame is a multi-link reconfiguration response frame.

[0071] In some embodiments, the second access point is a single-link device or a multi-link device, and the first association frame and the first association frame are transmitted on the same link or different links of the second access point.

[0072] In some embodiments, the first associated frame or the second associated frame is forwarded by the second access point in one of the following ways:

[0073] The second access point forwards all information from either the first associated frame or the second associated frame;

[0074] The second access point forwards information from the first associated frame or part of the second associated frame;

[0075] The second access point inserts the allocation identifier (AID) of the non-access point into the second associated frame before forwarding it;

[0076] The second access point parses and assembles the MAC frame header of the first or second associated frame, and forwards the frame body of the first or second associated frame.

[0077] The second access point parses and assembles the first or second associated frame, inserts the frame header information or AID information related to the second access point into the first or second associated frame, and then forwards it.

[0078] Through the embodiments of this application, SMD-level key information can be generated during the PASN process, enhancing secure communication between the SMD ME and non-AP. By using SMD-level key information to protect associated frames, secure and seamless mobile domain association is achieved, providing users with a more reliable and efficient network connection experience. This solves the problem in related technologies that it is impossible to protect associated frames between non-AP and SMD ME.

[0079] In other embodiments of this application, another method for associated frame protection in Seamless Mobile Domain SMD operating on the above-described network architecture is also provided, specifically, applied to non-access points. Figure 6 This is a flowchart (II) of the associated frame protection of Seamless Mobile Domain SMD according to an embodiment of this application, as shown below. Figure 6 As shown, the process includes the following steps:

[0080] Step S602: Generate SMD-level key information with the Seamless Mobility Domain Management Entity (SMD ME) through the Pre-Connection Security Negotiation (PASN) protocol.

[0081] Step S604: Interact with the SMD ME using the associated frame based on the key information at the SMD level.

[0082] The entity performing the above steps can be a non-access point (non-AP), also known as a STA.

[0083] Through the above steps, SMD-level key information can be generated during the PASN process, enhancing secure communication between the SMD ME and the non-access point (non-AP). By using SMD-level key information to protect associated frames, secure and seamless mobile domain association is achieved, providing users with a more reliable and efficient network connection experience. This solves the problem in related technologies that cannot protect associated frames between non-AP and SMD ME.

[0084] In some embodiments, prior to step S602, the method further includes: receiving a beacon frame or probe response frame sent by at least one access point; and determining the SMD information of the SMD where the at least one access point is located based on the beacon frame or the probe response frame.

[0085] In some embodiments, after receiving a beacon frame or probe response frame sent by at least one access point, the method further includes: in response to the beacon frame or probe response frame originating from multiple access points and the beacon frame or probe response frame sent by different access points carrying the same SMD information, determining that PASN protocol interaction and authentication frame interaction can be performed with the SMD ME through the different access points; or, in response to the required Neighbor Report (RNR) field or Neighbor Report (NR) field carried by the beacon frame or probe response frame indicating that a neighboring access point is located in the same SMD as the current access point, determining that PASN protocol interaction and authentication frame interaction can be completed with the SMD ME through the different access points.

[0086] The NR field is used to report a list of neighboring devices detected by the device, including the neighbor's MAC address, signal strength, channel information, etc., for network management and optimization. The RNR field is a variant of the NR field, used to indicate situations where specific information needs to be received from neighboring access points. For example, it can be used to indicate which neighboring access points are located in the same SMD as the current access point.

[0087] Figure 7This is a flowchart (II) of the PASN process in one embodiment of this application, as shown below. Figure 7 As shown, step S602 above, which is the process by which the non-access point generates SMD-level key information with the Seamless Mobility Domain Management Entity (SMDME) through the Pre-Connection Security Negotiation (PASN) protocol, may include the following steps:

[0088] Step S6022: Send a first PASN authentication frame to the SMD ME through the first access point within the SMD;

[0089] Step S6024: Receive a second PASN authentication frame from the SMD ME through the first access point;

[0090] Step S6026: Send a third PASN authentication frame to the SMD ME through the first access point.

[0091] The first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame carry SMD information. The first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame are used to implement an SMD-level PASN process between the SMD ME and the non-access point to generate the SMD-level key information.

[0092] In some embodiments, the SMD information includes at least one of the following: the Media Access Control (MAC) address of the SMD ME, the identifier of the SMD ME, and the capability set of the SMD ME. The capability set of the SMD ME may include, but is not limited to, the SMD ME's security capabilities, frequency support, and Multi-Link Operation (MLO) capabilities. The use of this SMD information ensures correct identification and key generation between the SMD ME and non-access points, achieving both seamless WiFi switching within the SMD and ensuring network connection security.

[0093] In some embodiments, at least one of the first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame includes an SMD element field, wherein the SMD element field includes at least one of the following: an element ID field, a length field, an SMD ID field, an SMD MAC address field, a Robust Security Network Element (RSNE) field, and a Robust Security Network Extension Element (RSNXE) field. At least one of the first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame may carry or indicate the aforementioned SMD information through the SMD element field.

[0094] In some embodiments, the first PASN authentication frame further carries at least one Pairwise Master Key Identifier (PMKID), wherein the PMKID is used to indicate SMD-level key information pre-generated and stored by the non-access point and the SMD ME; and / or, the PMKID is generated based on the MAC address of the non-access point and the MAC address of the SMD ME.

[0095] Figure 8 This is a schematic diagram (II) of the associated frame interaction process in one embodiment of this application, as shown below. Figure 8 As shown, step S604 above, which is the non-access point interacting with the SMD ME based on the SMD-level key information, may include the following steps:

[0096] Step S6042: Send a first association frame to the SMD ME through the second access point within the SMD;

[0097] Step S6044: Receive a second association frame from the SMD ME through the second access point;

[0098] The first associated frame and / or the second associated frame carry SMD information. The first associated frame and the second associated frame are encrypted and decrypted according to the SMD-level key information or the key information between the non-access point and the second access point. The first associated frame and the second associated frame are used to establish an SMD-level connection between the SMD ME and the non-access point.

[0099] In this embodiment, the second access point is any AP within the SMD. The first access point and the second access point can be the same AP or different APs.

[0100] In some embodiments, the SMD-level key information includes at least one of the following: an SMD-level Pairwise Master Key (PMK), an SMD-level Pairwise Transient Key (PTK), or a Pairwise Transient Key Security Association (PTKSA).

[0101] In one exemplary embodiment, the SMD-level PMK and / or the SMD-level PTK are generated based on the MAC address of the non-access point and the MAC address of the SMD ME.

[0102] In some embodiments, at least one of the following is included:

[0103] 1) The first associated frame is encrypted by the non-access point according to the SMD-level key information, and decrypted by the SMD ME according to the SMD-level key information;

[0104] 2) The second associated frame is encrypted by the SMD ME according to the SMD-level key information, and decrypted by the non-access point according to the SMD-level key information;

[0105] 3) The first associated frame is encrypted by the non-access point according to the SMD-level key information or the key information between the non-access point and the second access point, and is decrypted by the second access point according to the SMD-level key information or the key information between the non-access point and the second access point;

[0106] 4) The second associated frame is encrypted by the SMD ME according to the SMD-level key information or the key information between the non-access point and the second access point, and is decrypted by the second access point according to the SMD-level key information or the key information between the non-access point and the second access point.

[0107] In some embodiments, the key information between the non-access point and the second access point is generated based on the SMD-level key information and the identifier information of the second access point, wherein the identifier information of the second access point includes the MAC address of the second access point and / or other identifier information of the second access point.

[0108] In some embodiments, the first associated frame and the second associated frame are encrypted and decrypted based on the SMD-level key information and additional associated data (AAD) information, wherein the AAD information includes at least one of the following: the MAC address of the SMD ME, the MAC address of the second access point, the MAC address of the non-access point, the sender address (TA), and the receiver address (RA).

[0109] In some embodiments, the first associated frame or the second associated frame is forwarded by the second access point in one of the following ways:

[0110] The second access point forwards all information from either the first associated frame or the second associated frame;

[0111] The second access point forwards information from the first associated frame or part of the second associated frame;

[0112] The second access point inserts the allocation identifier (AID) of the non-access point into the second associated frame before forwarding it;

[0113] The second access point parses and assembles the MAC frame header of the first or second associated frame, and forwards the frame body of the first or second associated frame.

[0114] The second access point parses and assembles the first or second associated frame, inserts the frame header information or AID information related to the second access point into the first or second associated frame, and then forwards it.

[0115] This application implements a PASN process for non-AP MLD and SMD ME, and generates SMD-level key information (e.g., PTKSA, PTK). This key information is used for the associated frame protection (i.e., encryption and decryption) process of non-AP MLD and SMD ME interacting through an affiliated APMLD. The method is characterized by the following aspects:

[0116] 1) The PTK generated by the PASN at the SMD level can be used for encrypted protection of request / response frames associated with non-AP MLD and SMD ME through any AP MLD.

[0117] 2) When a non-APMLD uses different AP MLDs to associate request / response frames with an SMD ME, the PTKSA, PTK, or subkeys in the PTK (such as KDK, TK, etc.) generated by the SMD-level PASN are used for encryption protection. Depending on the AP MLD, the PTKSA, PTK, or subkeys in the PTK (such as KDK, TK, etc.) will generate a temporary key (TemporalKey, TK) corresponding to the AP MLD for encryption protection.

[0118] 3) The authentication frame contains SMD-level PMKID information, which is used for SMD ME retrieval and selection of a specific PMKSA.

[0119] This application's embodiments address the issue in related technologies where association frames cannot be protected when a non-AP MLD is associated with an SMD-ME. It implements an SMD-level PASN process, achieving association frame protection between the non-AP MLD and the SMD-ME. It also resolves the problem in related technologies where, when a mobile non-AP MLD roams within an SMD, the PTK generated by PASN with the first AP MLD cannot be used for the encryption and decryption of association request / response frames interacting with the SMD-ME via a second AP MLD. This achieves the technical effect of multiple AP MLDs sharing a key within an SMD, allowing the non-AP MLD to achieve secure and efficient seamless switching within the SMD with only one PASN process.

[0120] The SMD PASN process and the transmission associated frame protection process will be explained in detail below for multi-link operation scenarios.

[0121] Figure 9 This is a schematic diagram of the SMD PASN and transmission associated frame protection process in the embodiments of this application, as shown below. Figure 9 As shown, this process occurs between the SMD ME and the non-AP MLD, which are connected via a first AP MLD or a second APMLD. The process includes the following steps:

[0122] Step S0: Non-AP MLDs find that an SMD contains at least one AP MLD.

[0123] Step S1: The non-AP MLD sends a first SMD PASN authentication frame containing, but not limited to, SMD information to the SMD ME via AP MLD1.

[0124] In step S2, after receiving the first SMD PASN authentication frame, the SMD ME sends a second SMD PASN authentication frame containing, but not limited to, SMD information to the non-AP MLD via AP MLD1.

[0125] In step S3, after the non-AP MLD receives the second SMD PASN authentication frame, it sends the third SMD PASN authentication frame to the SMD ME through AP MLD1.

[0126] After the above three authentication frames are interacted, the non-AP MLD and SMD ME generate PTKSA and / or PTK (SMD level).

[0127] In step S4, the non-AP MLD generates a TK using PTKSA and / or PTK according to certain rules, and sends an association request frame encrypted with the TK to the SMD ME through AP MLD2.

[0128] In step S5, SMD ME generates TK using the same rules. After receiving the above association request frame, it sends an association response frame encrypted with the same TK to non-AP MLD through AP MLD2.

[0129] In the embodiments of this application, the association request frame and association response frame can also be replaced with a reassociation request frame and a reassociation response frame, or with a multi-link reconfiguration request frame and a multi-link reconfiguration response frame. The following embodiments are only described using association request frames and association response frames as examples, but this application is not limited thereto.

[0130] In this embodiment, AP MLD1 and AP MLD2 are located in the same SMD, and the signaling interaction between the non-AP MLD and SMD ME is forwarded through AP MLD1 or AP MLD2.

[0131] In some embodiments, in step S0 above, a non-AP MLD can discover that at least one AP MLD is contained within an SMD by either of the following methods: receiving beacon frames or probe response frames sent by at least two AP MLDs that contain the same SMD information; or, the RNR and NR fields carried by the beacon frames or probe response frames indicate that a neighboring AP MLD is located in the same SMD as this AP MLD.

[0132] In some embodiments, the SMD information includes at least one of the following: SMD ME MAC address information and SMD MEID information.

[0133] In some embodiments, during the PMK or PTK negotiation process, the non-AP MLD MAC is used as the MAC address of the supplicant, and the SMD ME MAC is used as the MAC address information of the authentication to generate the PMK or / and PTK.

[0134] For example, the PTK generation formula in the standard protocol IEEE 802.11az can be used to generate the PTK:

[0135] PTK=KDF-HASH-NNN(PMK,"PASN PTK Derivation",SPA||BSSID||DHss);

[0136] Where BSSID is the SMD ME MAC address and SPA is the non-AP MLD MAC address.

[0137] In some embodiments, the first authentication frame (i.e., the first SMD PASN authentication frame) includes PMKID information, wherein the PMKID information is one of the following:

[0138] (a) PMKID is used to indicate PMK information generated and saved before non-AP MLD and SMD ME.

[0139] (b) PMKID is generated using non-AP MLD MAC address, SMD ME MAC address, etc., as input parameters according to a certain algorithm. For example, the algorithm is as follows:

[0140] PMKID=Truncate-128(HMAC-SHA-1(PMK,"PMK Name"||AA||SPA));

[0141] Where AA is the SMD ME MAC address; SPA is the non-AP MLD MAC address.

[0142] (c) After receiving the above authentication frame, the SMD ME will check whether the information in the PMKID list matches the cached PMKSA. If they do not match, the SMD ME will send a second authentication frame containing a status code indicating an invalid PMKID. If a matching PMKSA is found, the SMD ME will send a second authentication frame containing the PMKID information selected by the SMD ME (this information may be located in the PMKID list field of the RSNE element).

[0143] In some embodiments, the process of exchanging PMKID information between the non-AP MLD and the SMD ME using the first authentication frame and the second authentication frame is applicable not only to PASN, but also to other processes, such as the non-AP MLD authentication and association process with the SMD ME, the fast authentication and association process in FILS mode, and the fast transfer process (or roaming process) of the non-AP MLD between SMDs.

[0144] In some embodiments, the PASN frame interaction process and associated frames (including associated request frames and associated response frames) may be completed on the same or different links of the same AP MLD.

[0145] In some embodiments, the PASN frame interaction process and associated frames (including associated request frames and associated response frames) may be completed on a link of different AP MLDs of the same SMD.

[0146] In some embodiments, the interaction of the three authentication frames during the PASN frame interaction process may be completed on the same or different links of the same AP MLD.

[0147] In some embodiments, the SMD ME stores a unique SMD-level PTKSA, and the AP MLD is only responsible for forwarding the association request frame and association response frame between the non-APMLD and the SMD ME, without performing encryption or decryption processing.

[0148] In some embodiments, the AP MLD within the SMD participates in the interaction process of association request frames and association response frames between the non-AP MLD and the SMD ME. For example, the AP MLD can adopt any of the following methods:

[0149] 1) AP MLD decrypts the received association request frame and forwards the association request frame to SMD ME.

[0150] 2) Receive the associated response frame sent by SMD ME, encrypt the associated response frame and send it to non-AP MLD.

[0151] 3) AP MLD only forwards partial information from the associated request frame and associated response frame, such as the SMD element fields of the associated request frame and associated response frame.

[0152] 4) After the AP MLD assigns an AID (Association Identifier) ​​to the non-AP MLD, it inserts the AID information into the association response frame and sends it to the non-AP MLD.

[0153] 5) The AP MLD is responsible for assembling and parsing the MAC frame header, and only forwards the frame body of the associated request frame and associated response frame.

[0154] 6) SMD ME assembles and parses the entire association request frame and association response frame, obtains partial information of the association request frame and association response frame from AP MLD, such as the frame header and AID part, and inserts it into the frame structure.

[0155] In this embodiment, the interaction process between the association request frame and the association response frame can also be replaced by the interaction process between the reassociation request frame and the reassociation response frame, or by the interaction process between the multi-link reconfiguration request frame and the multi-link reconfiguration response frame.

[0156] In some embodiments, SMD-level PTKSA or PTK (denoted as PTK) smd Subkeys such as KDK (denoted as KDK) smd ), TK (noted as TK) smd Generate the corresponding PTK (denoted as PTK) based on the MAC address of each AP MLD within the SMD and / or the SMD MAC address and / or the MAC address of the non-access point. mld ) or TK (noted TK) mld For example, TK information can be generated in the following ways:

[0157] TK mld =KDF-HASH-NNN(PTK) smd "TK Derivation", non-AP MLD MAC, SMD MAC, APMLD MAC); or,

[0158] TK mld =KDF-HASH-NNN(TK) smd "TK Derivation", non-AP MLD MAC, SMD MAC, AP MLDMAC); or,

[0159] TK mld =KDF-HASH-NNN(KDK) smd "TK Derivation", non-AP MLD MAC, SMD MAC, APMLD MAC); or,

[0160] PTK mld =KDF-HASH-NNN(PTK) smd "PTK Derivation", non-AP MLD MAC, SMD MAC, APMLD MAC); or,

[0161] PTK mld =KDF-HASH-NNN(KDK) smd , "PTK Derivation", non-AP MLD MAC, SMD MAC, APMLD MAC);

[0162] Among them, PTK mld It can be further decomposed into KCK used to generate MIC information. mld TK for unicast frame encryption and decryption mld This may also include KDK used to generate other key information. mld .

[0163] In some embodiments, during the encryption and decryption of associated frames, the AAD information includes one of the following: SMD MEMAC address, AP MLD MAC address, non-AP MLD MAC address, Transmitter Address (TA), and Receiver Address (RA).

[0164] In some embodiments, the SMD-level PTK can also be used to protect the reassociation request frames and reassociation response frames of the interaction between the non-AP MLD and the SMD ME, or to protect the multi-link reconfiguration request frames and multi-link reconfiguration response frames of the interaction between the non-AP MLD and the SMD ME.

[0165] In some embodiments, the behavior of the non-AP MLD described above also applies to single-link terminal devices. For single-link terminal devices, the non-AP MLD MAC address in each of the above embodiments can be replaced with the non-AP STA MAC address.

[0166] In some embodiments, the three SMD PASN authentication frames described above can be extended based on the IEEE 802.11az protocol by adding an SMD element field to each of the original SMD PASN authentication frames.

[0167] Figure 10 This is a schematic diagram of the extended format of the first SMD PASN authentication frame in an embodiment of this application.

[0168] Figure 11 This is a schematic diagram of the extended format of the second SMD PASN authentication frame in an embodiment of this application.

[0169] Figure 12 This is a schematic diagram of the extended format of the third SMD PASN authentication frame in the embodiments of this application.

[0170] like Figure 10 , Figure 11 , Figure 12 As shown, SMD element fields can be added to the structures of the first SMD PASN authentication frame, the second SMD PASN authentication frame, and the third SMD PASN authentication frame. During the SMD PASN process, at least one of the first, second, and third authentication frames uses an extended format, while the other authentication frames can use either the extended format or the original format (without SMD element fields).

[0171] Figure 13 This is a schematic diagram of the format of the SMD element field in the embodiments of this application, such as... Figure 13 As shown, the format includes the following structure:

[0172] The Element ID field is used to indicate the element's ID information, uniquely identifying an element;

[0173] The Length field indicates the length of the element.

[0174] The SMD ID field is used to indicate the identifier information of the SMD, which may be a globally unique or locally unique identifier;

[0175] The SMD MAC address field is used to indicate the 48-bit SMD MAC address information;

[0176] The RSNE field is used to indicate the supported RSNE capabilities or the selected RSNE information, including PMKID information;

[0177] The RSNXE field is used to indicate the supported RSNXE capabilities or the selected RSNXE information.

[0178] In this embodiment, the SMD element field can carry the SMD's identifier information and MAC address information to uniquely identify the SMD. The RSNE and RSNXE information can be used to indicate the SMD's key information generation capability. By carrying SMD information in the authentication frame of the PASN process, an SMD-level PASN process can be implemented, generating key information shared by multiple APs within the SMD (SMD level). This not only enables secure connections but also simplifies the secure connection establishment process and improves AP access efficiency.

[0179] Through the various embodiments of this application, a method for establishing an SMD-level PASN and protecting associated frames between a multi-link STA and an SMD ME is implemented. An SMD-level PTK can be generated using the MAC address information of the non-AP MLD and the SMD ME. The SMD-level PTK or TK can then be used to encrypt and decrypt the associated frames. Furthermore, an AP MLD-level PTK or TK can be generated based on the SMD-level PTK, and used to encrypt and decrypt the associated frames. Therefore, the method in the embodiments of this application enhances secure communication between the SMD ME and the non-access point. By using SMD-level key information to protect associated frames, secure and seamless mobile domain association is achieved, providing users with a more reliable and efficient network connection experience. This solves the problem in related technologies where associated frames between non-AP and SMD ME cannot be protected.

[0180] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0181] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps in any of the above method embodiments.

[0182] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0183] Embodiments of this application also provide an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0184] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0185] Embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0186] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0187] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0188] The above description is merely an exemplary embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for protecting associated frames in a seamless mobile domain (SMD), characterized in that, The method, applied to the Seamless Mobile Domain Management (SMD) entity ME, includes: SMD-level key information is generated with the non-access point through the PASN protocol pre-connection security negotiation. The association frame is exchanged with the non-access point based on the SMD-level key information.

2. The method according to claim 1, characterized in that, The process of generating SMD-level key information with the non-access point via the Pre-Connection Security Negotiation (PASN) protocol includes: Receive the first PASN authentication frame from the non-access point through the first access point within the SMD; Send a second PASN authentication frame to the non-access point through the first access point; Receive a third PASN authentication frame from the non-access point through the first access point; At least one of the first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame carries SMD information. The first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame are used to implement an SMD-level PASN process between the SMD ME and the non-access point to generate the SMD-level key information.

3. The method according to claim 2, characterized in that, The SMD information includes at least one of the following: the SMD ME's Media Access Control (MAC) address, the SMD ME's identifier, and the SMD ME's capability set.

4. The method according to claim 2, characterized in that, At least one of the first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame includes an SMD element field, wherein the SMD element field includes at least one of the following: an element identifier field, a length field, an SMD identifier field, an SMD MAC address field, a robust secure network element RSNE field, and an extended robust secure network element RSNXE field.

5. The method according to claim 2, characterized in that, The first access point is a single-link device or a multi-link device, and the first PASN authentication frame, the second PASN authentication frame and the third PASN authentication frame are transmitted on the same link or different links of the first access point.

6. The method according to claim 2, characterized in that, The first PASN authentication frame also carries at least one pair master key identifier PMKID, wherein, The PMKID is used to indicate the SMD-level key information pre-generated and stored by the SMD ME between the non-access point and the SMD ME; and / or, The PMKID is generated based on the MAC address of the non-access point and the MAC address of the SMD ME.

7. The method according to claim 6, characterized in that, The method further includes: Check whether the PMKID matches the pre-saved SMD-level key information; In response to the PMKID not matching the pre-saved SMD-level key information, the second PASN authentication frame also carries a status code indicating that the PMKID is invalid; or, in response to the PMKID matching the pre-saved SMD-level key information, the second PASN authentication frame also carries the PMKID selected by the SMD ME from the successfully matched PMKIDs.

8. The method according to claim 1, characterized in that, The SMD-level key information includes at least one of the following: SMD-level paired master key PMK, SMD-level paired temporary key PTK, paired temporary key secure connection PTKSA, and paired master key secure connection PMKSA.

9. The method according to claim 8, characterized in that, The SMD-level PMK and / or the SMD-level PTK are generated based on the MAC address of the non-access point and the MAC address of the SMD ME.

10. The method according to claim 1, characterized in that, The step of interacting with the non-access point using the SMD-level key information includes: The first associated frame is received from the non-access point through the second access point within the SMD, wherein the second access point is any access point within the SMD; Send a second association frame to the non-access point through the second access point; Both the first associated frame and the second associated frame carry SMD information. The first associated frame and the second associated frame are encrypted and decrypted based on the SMD-level key information or the key information between the non-access point and the second access point. The first associated frame and the second associated frame are used to establish an SMD-level connection between the SMD ME and the non-access point.

11. The method according to claim 10, characterized in that, Includes at least one of the following: The first associated frame is encrypted by the non-access point according to the SMD-level key information, and decrypted by the SMDME according to the SMD-level key information; The second associated frame is encrypted by the SMD ME according to the SMD-level key information, and decrypted by the non-access point according to the SMD-level key information; The first associated frame is encrypted by the non-access point according to the SMD-level key information or the key information between the non-access point and the second access point, and is decrypted by the second access point according to the SMD-level key information or the key information between the non-access point and the second access point; The second associated frame is encrypted by the SMD ME according to the SMD-level key information or the key information between the non-access point and the second access point, and is decrypted by the second access point according to the SMD-level key information or the key information between the non-access point and the second access point.

12. The method according to claim 11, characterized in that, The key information between the non-access point and the second access point is generated based on the SMD-level key information and the identifier information of the second access point, wherein the identifier information of the second access point includes the MAC address of the second access point and / or other identifier information of the second access point.

13. The method according to claim 10, characterized in that, The first associated frame and the second associated frame are encrypted and decrypted based on the SMD-level key information and additional association data (AAD) information, wherein the AAD information includes at least one of the following: The MAC address of the SMD ME, the MAC address of the second access point, the MAC address of the non-access point, the sender address TA, and the receiver address RA.

14. The method according to claim 10, characterized in that, The first association frame is an association request frame, and the second association frame is an association response frame; or, The first association frame is a reassociation request frame, and the second association frame is a reassociation response frame; or, The first associated frame is a multi-link reconfiguration request frame, and the second associated frame is a multi-link reconfiguration response frame.

15. The method according to claim 10, characterized in that, The second access point is a single-link device or a multi-link device, and the first associated frame and the first associated frame are transmitted on the same link or different links of the second access point.

16. The method according to claim 10, characterized in that, The first associated frame or the second associated frame is forwarded by the second access point in one of the following ways: The second access point forwards all information from either the first associated frame or the second associated frame; The second access point forwards information from the first associated frame or part of the second associated frame; The second access point inserts the allocation identifier (AID) of the non-access point into the second associated frame before forwarding it; The second access point parses and assembles the MAC frame header of the first or second associated frame, and forwards the frame body of the first or second associated frame. The second access point parses and assembles the first or second associated frame, inserts the frame header information or AID information related to the second access point into the first or second associated frame, and then forwards it.

17. A method for protecting associated frames in a seamless mobile domain (SMD), characterized in that, Applied to non-access points, the method includes: SMD-level key information is generated by using the Pre-Connect Security Negotiation (PASN) protocol and the Seamless Mobile Domain Management (SMD) ME. The SMD-level key information is used to perform association frame interaction with the SMD ME.

18. The method according to claim 17, characterized in that, Before generating SMD-level key information with the Seamless Mobile Domain Management Entity (SMD ME) via the Pre-Connection Security Negotiation (PASN) protocol, the method further includes: Receive at least one beacon frame or probe response frame sent by an access point; The SMD information of the SMD where the at least one access point is located is determined based on the beacon frame or the probe response frame.

19. The method according to claim 18, characterized in that, After receiving a beacon frame or probe response frame sent by at least one access point, the method further includes: In response to the beacon frame or the probe response frame originating from multiple access points, and the beacon frame or probe response frame sent by different access points carrying the same SMD information, it is determined that PASN protocol interaction and authentication frame interaction can be performed with the SMD ME through the different access points; or, In response to the Required Neighbor Report (RNR) field or Neighbor Report (NR) field carried in the beacon frame or the probe response frame indicating that a neighboring access point is located in the same SMD as the current access point, it is determined that PASN protocol interaction and authentication frame interaction can be completed with the SMD ME through the different access points.

20. The method according to claim 17, characterized in that, The generation of SMD-level key information through the Pre-Connection Security Negotiation (PASN) protocol and the Seamless Mobile Domain Management (SMD) ME includes: Send the first PASN authentication frame to the SMD ME through the first access point within the SMD; Receive a second PASN authentication frame from the SMD ME through the first access point; Send a third PASN authentication frame to the SMD ME through the first access point; The first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame carry SMD information. The first PASN authentication frame, the second PASN authentication frame, and the third PASN authentication frame are used to implement an SMD-level PASN process between the SMD ME and the non-access point to generate the SMD-level key information.

21. The method according to claim 17, characterized in that, The step of interacting with the SMD ME based on the SMD-level key information includes: The first association frame is sent to the SMD ME through the second access point within the SMD; Receive a second associated frame from the SMD ME through the second access point; The first associated frame and / or the second associated frame carry SMD information. The first associated frame and the second associated frame are encrypted and decrypted according to the SMD-level key information or the key information between the non-access point and the second access point. The first associated frame and the second associated frame are used to establish an SMD-level connection between the SMD ME and the non-access point.

22. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 16, or implements the steps of the method described in any one of claims 17 to 21.

23. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 16, or the steps of the method described in any one of claims 17 to 21.

24. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 16, or the steps of the method described in any one of claims 17 to 21.

Images