Multi-access point (MAP) authentication method, storage medium, electronic device, and computer program product

Abstract

Embodiments of the present application provide a multi-access point (MAP) authentication method, a storage medium, an electronic device and a computer program product. The method comprises: a first access point (AP) sending a first common action frame carrying authentication group identifier (AGID) information of the first AP to a second AP, so that the second AP can obtain the AGID information of the first AP. The AGID information is exchanged between multiple APs to determine whether the APs can authenticate each other. Thus, the problem that an AP supporting a MAPC function cannot determine whether it can authenticate another AP is solved.

Description

Technical Field

[0001] This application relates to the field of communications, and more specifically, to a multi-access point (MAP) authentication method, storage medium, electronic device, and computer program product. Background Technology

[0002] Multi-Access Point Coordination (MAPC) technology, as an important technology of Wi-Fi 8, has been widely discussed by the working group. It aims to improve channel utilization, increase overall system throughput, and reduce latency through MAPC. In a MAPC scenario, different Extended Service Sets (ESSs) can be deployed to different homes by the same Internet Service Provider (ISP). Each ESS contains at least one Access Point (AP) and one user terminal device. The ISP may only allow certain ESSs (such as ESS1 and ESS2, ESS3 and ESS4) to perform MAPC operations. For example, it might configure the same key information for APs within ESS1 and ESS2. These APs then complete mutual authentication using the Simultaneous Authentication of Equals using password (SAE using password) method.

[0003] However, the following problems still exist in the current MAPC scenario:

[0004] Question 1: APs supporting MAPC functionality cannot determine whether they can mutually authenticate with another AP. For an AP (AP1) supporting MAPC functionality, after receiving a common action frame from another AP (AP2), it cannot determine whether it can mutually authenticate with AP2 and generate key information to protect subsequent management frame interactions based on mutual authentication.

[0005] Question 2: APs supporting MAPC may contain multiple authentication information sets, making it impossible to determine which set to use for mutual authentication with another AP. For an AP supporting MAPC (AP1), which may contain multiple sets of authentication information sets, AP1 cannot determine which set to use for mutual authentication with AP2 and complete mutual authentication based on the same authentication information (such as password information) to generate key information to protect subsequent management frame interactions.

[0006] There is currently no good solution to the above problems. Summary of the Invention

[0007] This application provides a multi-access point (MAP) authentication method, storage medium, electronic device, and computer program product to at least solve the problem in related technologies where APs supporting MAPC functionality cannot determine whether they can mutually authenticate with another AP.

[0008] According to one embodiment of this application, a multi-access point (MAP) authentication method is provided, applied to a first access point (AP). The method includes sending a first common action frame carrying the authentication group ID (AGID) information of the first AP to a second AP.

[0009] According to another embodiment of this application, a multi-access point (MAP) authentication method is provided, applied to a second access point (AP). The method includes: receiving a first common action frame from a first AP carrying authentication group identifier (AGID) information of the first AP.

[0010] According to yet another embodiment of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein the computer program, when executed by a processor, implements the steps in any of the above method embodiments.

[0011] According to yet another embodiment of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in any of the above method embodiments.

[0012] According to yet another embodiment of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0013] Through the above embodiments of this application, the first access point (AP) sends a first common action frame carrying the authentication group identifier (AGID) information of the first AP to the second AP, enabling the second AP to obtain the AGID information of the first AP. Multiple APs can determine whether they can authenticate each other by exchanging AGID information, thereby solving the problem in related technologies where APs supporting MAPC functions cannot determine whether they can authenticate with another AP. Attached Figure Description

[0014] Figure 1 This is a schematic diagram (a) of the MAPC network architecture according to an embodiment of this application;

[0015] Figure 2 This is a schematic diagram (II) of the MAPC network architecture according to an embodiment of this application;

[0016] Figure 3 This is a flowchart (I) of the MAP authentication method according to an embodiment of this application;

[0017] Figure 4 This is a flowchart (II) of the MAP authentication method according to an embodiment of this application;

[0018] Figure 5 This is a schematic diagram of an authentication process based on an AGID information in one embodiment of this application;

[0019] Figure 6 This is a schematic diagram of an authentication process based on an AGID in the AGID list in one embodiment of this application;

[0020] Figure 7 This is a schematic diagram of the overall process of MAP authentication based on AGID information in one embodiment of this application;

[0021] Figure 8 This is a schematic diagram of the format of the AGID element field in one embodiment of this application;

[0022] Figure 9 This is a schematic diagram of the format of an action frame in one embodiment of this application. Detailed Implementation

[0023] The embodiments of this application will be described in detail below with reference to the accompanying drawings and examples.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0025] The embodiments of this application can be applied to the Multiple Access Point Coordination (MAPC) scenario.

[0026] Figure 1 This is a schematic diagram (I) of the MAPC network architecture according to an embodiment of this application, as shown below. Figure 1 As shown, ESS1 to ESS4 (each representing a different user home, with each ESS containing at least one AP and user terminal equipment) are deployed to different homes by the same Internet Service Provider (ISP). However, the ISP may only allow ESS1 and ESS2 to perform MAPC operations, such as configuring the same key information for the APs in ESS1 and ESS2. These APs complete mutual authentication using the peer-to-peer authentication (SAE using password) method based on the same key.

[0027] Figure 2This is a schematic diagram (II) of the MAPC network architecture according to an embodiment of this application, as shown below. Figure 2 As shown, ESS1 and ESS2 are deployed from ISP1 to Home 1 and Home 2, and ESS3 and ESS4 are deployed from ISP2 to Home 3 and Home 4. MAPC operations may not be possible between different ISPs, and ISP1 may only allow ESS1 and ESS2 to perform MAPC operations, while ISP2 may only allow ESS3 and ESS4 to perform MAPC operations.

[0028] In some embodiments of this application, a multi-access point (MAP) authentication method is provided that operates on the above-described network architecture and is applied to a first access point (AP). Figure 3 This is a flowchart (I) illustrating the MAP authentication method according to an embodiment of this application, as follows: Figure 3 As shown, the process includes the following steps:

[0029] Step S301: Send a first public action frame carrying the authentication group identifier (AGID) information of the first AP to the second AP.

[0030] Through the above steps, the second AP can obtain the AGID information of the first AP. Multiple APs can determine whether they can authenticate each other by exchanging AGID information, thereby solving the problem in related technologies that APs supporting MAPC function cannot determine whether they can authenticate with another AP.

[0031] The entity performing the above steps can be the first AP. The first AP and the second AP can be routers, gateway devices, etc., but are not limited to these.

[0032] In some embodiments, after receiving the first common action frame, the second AP can determine whether it can mutually authenticate with the first AP based on the AGID information carried in the first common action frame, that is, whether the two are in the same authentication group (AG). In this embodiment, each authentication group has a unique identifier, and APs within the authentication group can authenticate each other. The authentication group and AGID information can be configured by network operators, network administrators, users, etc.

[0033] In some embodiments, each authentication group can be associated with specific key information, and multiple APs within an authentication group can authenticate each other based on the key information corresponding to that authentication group. Each AP can belong to one or more authentication groups, and correspondingly, the AGID information of each AP can be one / a group, or multiple / multiple groups.

[0034] In some embodiments, after receiving the first common action frame, if the second AP determines that it can mutually authenticate with the first AP, it can send a second common action frame or a first authentication frame to the first AP. The second common action frame can be a response message to the first common action frame, for example, indicating that the second AP agrees to authenticate with the first AP. The first authentication frame signifies the formal start of the authentication process.

[0035] In some embodiments, the method further includes: step S302, whereby the first AP receives a second common action frame or a first authentication frame from the second AP, specifically, one of the following:

[0036] 1) Receive a second common action frame or a first authentication frame from the second AP in response to the second AP determining, based on the AGID information of the first AP, that it has the capability to perform mutual authentication with the first AP;

[0037] 2) Receive the second common action frame or the first authentication frame from the second AP in response to the second AP determining that the AGID information of the first AP is wildcard type AGID information;

[0038] 3) Receive the second common action frame or the first authentication frame from the second AP in response to the second AP determining that the receiving address of the first common action frame is the media access control MAC address of the second AP;

[0039] 4) Regardless of whether the response conditions in 1) to 3) above are met, the second common action frame or the first authentication frame can be received from the second AP. That is, the second AP does not need to perform information matching and judgment on the content of the first common action frame, or, regardless of whether the information matching result is successful or unsuccessful, the second AP will send the second common action frame or the first authentication frame.

[0040] In other embodiments, the second AP may also not have the ability to mutually authenticate with the first AP. That is, the method may further include: the first AP not receiving the second common action frame or the first authentication frame from the second AP in response to the second AP determining, based on the AGID information of the first AP, that it does not have the ability to mutually authenticate with the first AP.

[0041] In some embodiments, the second public action frame carries the AGID information of the second AP or the target AGID information, and the first authentication frame carries the target AGID information, which is determined from the AGID information of the first AP and / or the AGID information of the second AP.

[0042] In some embodiments, the AGID information of the first AP or the second AP may include only one or a group of AGID information, or it may include multiple or more groups of AGID information; for example, it may be a list of AGID information. If multiple or more groups of AGID information exist, the first AP can negotiate with the second AP through a common action frame to determine the target AGID information to be selected, and then mutually authenticate each other based on the key information corresponding to the AGID information. The target AGID information may also be a list of target AGID information.

[0043] In some embodiments, the AGID information includes one of the following: AGID, vendor identifier, multi-access point collaboration identifier (MAPC ID), or the AGID information is wildcard type AGID information, wherein the wildcard type AGID information is used to indicate that the first AP and the second AP use open mode for mutual authentication, that is, any two APs can authenticate based on the wildcard type AGID information.

[0044] In some embodiments, the first public action frame or the second public action frame includes:

[0045] The type field indicates the purpose of the frame;

[0046] Public action frame field;

[0047] The AGID element field is used to carry at least one AGID information.

[0048] The Robust Security Network Element (RSNE) field indicates the key suite and capability set of a robust security network; and

[0049] The Robust Security Network Extension Element (RSNXE) field is used to indicate additional key sets and capability sets for a Robust Security Network (RSN).

[0050] In one exemplary embodiment, the RSNE field includes at least one of the following: Element ID, Length, Version, Group Data Cipher Suite information, Pairwise Cipher Suite Count, Pairwise Cipher Suite List, AKM Suite Count, AKM Suite List, RSN Capabilities, PMKID Count, PMKID List, and Group Management Cipher Suite information.

[0051] In some embodiments, when the first public action frame satisfies a preset first condition, the first AP and the second AP can authenticate each other, wherein the preset first condition includes one of the following:

[0052] 1) The AGID information of the first AP carried in the first public action frame includes wildcard AGID information;

[0053] 2) The AGID information of the first AP carried in the first public action frame is partially or entirely the same as the AGID information of the second AP;

[0054] 3) The AGID information of the first AP carried in the first public action frame contains at least a specific AGID information from the AGID information of the second AP;

[0055] 4) The key suite capability set information carried by the first public action frame is partially or entirely the same as the key suite capability set information of the second AP, wherein the key suite capability set information includes RSNE information and / or RSNXE information.

[0056] In some embodiments, the AGID information of the second AP or the target AGID information carried by the second public action frame or the first authentication frame is partially or entirely the same as the AGID information of the first AP carried by the first public action frame; and / or, in response to receiving the second public action frame from the second AP, the key suite capability set information carried by the second public action frame is partially or entirely the same as the key suite capability set information carried by the first public action frame, wherein the key suite capability set information includes RSNE information and / or RSNXE information.

[0057] In this embodiment, the first AP and the second AP can not only confirm whether they can authenticate each other by matching AGID information, but also confirm whether they can authenticate each other based on the key suite capability set information supported by the first AP and the second AP, making the method of determining authentication information more flexible.

[0058] In some embodiments, step S302 can be divided into the following two types:

[0059] In step S302A, the first AP receives the second common action frame from the second AP.

[0060] In step S302B, the first AP receives the first authentication frame from the second AP.

[0061] In some embodiments, for step S302A, the method further includes the following steps:

[0062] Step S303A: In response to receiving the second common action frame sent by the second AP, send the first authentication frame to the second AP;

[0063] Step S304A: Receive the second authentication frame from the second AP;

[0064] Step S305A: Send a third authentication frame to the second AP.

[0065] In some embodiments, for step S302B, the method further includes the following steps:

[0066] Step S303B: In response to receiving the first authentication frame sent by the second AP, send a second authentication frame to the second AP;

[0067] Step S304B: Receive a third authentication frame from the second AP.

[0068] In this embodiment, after receiving the first common action frame, the second AP can initiate an authentication process with the first AP after confirming that the two can authenticate each other. Alternatively, the second AP can simply send the second common action frame back to the first AP, and then the first AP can initiate an authentication process with the second AP.

[0069] In some embodiments, the first authentication frame is an authentication request frame, the second authentication frame is an authentication response frame, and the third authentication frame is an authentication confirmation frame.

[0070] In one exemplary embodiment, the formats of the first authentication frame, the second authentication frame, and the third authentication frame can be implemented based on the three PASN authentication frame extensions in the Pre-Association Security Negotiation (PASN) protocol defined in IEEE 802.11az. PASN authentication frames perform authentication between the AP and the STA, while the authentication frames in this application perform authentication between two APs.

[0071] In some embodiments, the first authentication frame and the second authentication frame include an AGID element field, an RSNE field, and / or an RSNXE field. The second authentication frame also includes a status code field, wherein the AGID element field of the first authentication frame and the AGID element field of the second authentication frame carry the same or different AGID information; and / or, the status code field of the second authentication frame carries a status code to indicate at least one of the following: AGID information mismatch, Authentication Key Management (AKM) information mismatch, unicast key suite information mismatch, or success. A success status code means that the AGID information, AKM information, and / or unicast key suite information match successfully.

[0072] In some embodiments, both the first authentication frame and the second authentication frame carry the target AGID information. The method further includes: the first AP obtaining or generating key information based on the target AGID information, and completing mutual authentication with the second AP based on the key information, wherein the first AP and the second AP obtain or generate the same key information based on the target AGID information.

[0073] In this embodiment, the first AP and the second AP can not only confirm that they can authenticate each other, but also, when the first AP or the second AP supports multiple sets of AGID information, the first AP and the second AP can determine which set of AGID information to use for authentication based on the target AGID information, which can improve authentication efficiency.

[0074] In some embodiments, the second authentication frame and / or the third authentication frame also carry a Message Integrity Code (MIC), and AGID information can be used as an input parameter in the generation process of the MIC value in the second authentication frame and / or the third authentication frame. Specifically, the generation process of MIC1 or MIC2 includes at least one of the following parameters:

[0075] AP1 MAC address, AP1 BSSID information, first action frame RSNE information, first action frame RSNXE information, first action frame AGID information, RSNE information in AP1 beacon frame, RSNXE information in AP1 beacon frame, second authentication frame body, first authentication frame RSNE information, first authentication frame RSNXE information;

[0076] AP2 MAC address, AP2 BSSID information, second action frame RSNE information, second action frame RSNXE information, second action frame AGID information, RSNE information in AP2 beacon frame, RSNXE information in AP2 beacon frame, first authentication frame body, and third authentication frame body;

[0077] Second authentication frame RSNE information, second authentication frame RSNXE information.

[0078] In an exemplary embodiment, MIC1 = HMAC-HASH(KCK, AP1 MAC|| AP2 MAC|| First Action Frame RSNE|| First Action Frame RSNXE|| First Action Frame AGID|| Second Authentication Frame Body).

[0079] In an exemplary embodiment, MIC2 = HMAC-HASH(KCK, AP1 MAC || AP2 MAC || Second Authentication Frame Body || Third Authentication Frame Body); or, MIC2 = HMAC-HASH(KCK, AP1 MAC || AP2 MAC || Second Action Frame RSNE || Second Action Frame RSNXE || Second Action Frame AGID || First Authentication Frame Body || Third Authentication Frame Body).

[0080] Among them, HMAC-HASH is a hash-based message authentication code (HMAC) based on a hash function (HASH), KCK is the key confirmation key, AP1 MAC and AP2 MAC are the MAC addresses of the first AP and the second AP, respectively, and the first action frame RSNE, the first action frame RSNXE, and the first action frame AGID are the corresponding information obtained from the first common action frame.

[0081] In some embodiments, the first public action frame, the second public action frame, the first authentication frame, and the second authentication frame also carry a Basic Service Set Identifier (BSSID). The BSSID includes one of the following: the MAC address of the first AP, the MAC address of the second AP, and a wildcard MAC address.

[0082] In some embodiments, the first authentication frame, the second authentication frame, and the third authentication frame further carry an authentication algorithm number field and / or an authentication key management (AKM) field, wherein the authentication algorithm number field and / or the authentication key management (AKM) field are used to indicate mutual authentication between the first AP and the second AP.

[0083] In this embodiment, mutual authentication between APs can be performed using a specified authentication algorithm or authentication key through authentication frames, providing greater flexibility in the authentication method. Furthermore, the authentication scope has been expanded to include AP-to-AP authentication, rather than the traditional AP-to-STA authentication.

[0084] In some embodiments, the first AP and the second AP are single-link access points, multi-link access points (APMLD), non-collocated multi-link access points (non-collocated AP MLD), seamless mobility domain (SMD) access points, or access points participating in multi-access point cooperation (MAPC) operations.

[0085] In an exemplary embodiment, the AP MLD may include multiple links in different frequency bands, such as 2.4GHz, 5GHz, 6GHz and 60GHz. The AP MLD can complete the interaction of the above-mentioned common action frames and authentication frames on the same link or different links.

[0086] Through the embodiments described above in this application, the first AP can interact with the second AP to exchange AGID information, negotiate and confirm the authentication information to be used, and complete the authentication process, thus achieving efficient and secure mutual authentication between multiple access points. This method not only reduces latency in the authentication process but also enhances network security, especially in multi-link and seamless mobile domain environments, significantly improving user experience and ensuring the continuity and reliability of data transmission. Furthermore, by using wildcard AGID information, this method also supports authentication in open mode, enhancing interoperability and flexibility between access points.

[0087] In some embodiments of this application, a multi-access point (MAP) authentication method operating on the above-described network architecture is also provided, applied to a second AP. Figure 4 This is a flowchart (II) of the MAP authentication method according to an embodiment of this application, as shown below. Figure 4 As shown, the process includes the following steps:

[0088] Step S401: Receive a first public action frame from the first AP carrying the authentication group identifier (AGID) information of the first AP.

[0089] Through the above steps, the second AP can obtain the AGID information of the first AP. Multiple APs can determine whether they can authenticate each other by exchanging AGID information, thereby solving the problem in related technologies that APs supporting MAPC function cannot determine whether they can authenticate with another AP.

[0090] The entity performing the above steps can be a second access point (AP). The first and second APs can be routers, gateway devices, etc., but are not limited to these.

[0091] In some embodiments, after receiving the first common action frame, the second AP can determine whether it can mutually authenticate with the first AP based on the AGID information carried in the first common action frame, that is, whether the two are in the same authentication group (AG). In this embodiment, each authentication group has a unique identifier, and APs within the authentication group can authenticate each other. The authentication group and AGID information can be configured by network operators, network administrators, users, etc.

[0092] In some embodiments, each authentication group can be associated with specific key information, and multiple APs within an authentication group can authenticate each other based on the key information corresponding to that authentication group. Each AP can belong to one or more authentication groups, and correspondingly, the AGID information of each AP can be one / a group, or multiple / multiple groups.

[0093] In some embodiments, the method further includes step S402, in which the second AP sends a second common action frame or a first authentication frame to the first AP. Specifically, this may include one of the following:

[0094] 1) In response to determining, based on the AGID information of the first AP, that it has the capability to perform mutual authentication with the first AP, a second common action frame or a first authentication frame is sent to the first AP.

[0095] 2) In response to determining that the AGID information of the first AP is wildcard type AGID information, send the second common action frame or the first authentication frame to the first AP;

[0096] 3) In response to determining that the receiving address of the first common action frame is the media access control (MAC) address of the second AP, send the second common action frame or the first authentication frame to the first AP;

[0097] 4) Regardless of whether the response conditions in 1) to 3) above are met, the second common action frame or the first authentication frame can be sent to the first AP. That is, the second AP does not need to perform information matching and judgment on the content of the first common action frame, or, regardless of whether the information matching result is successful or unsuccessful, the second AP will send the second common action frame or the first authentication frame.

[0098] In other embodiments, the second AP may also not have the ability to mutually authenticate with the first AP. That is, the method may further include: in response to determining, based on the AGID information of the first AP, that it does not have the ability to mutually authenticate with the first AP, not sending the second common action frame or the first authentication frame to the first AP.

[0099] In some embodiments, the second public action frame described above carries the AGID information of the second AP or the target AGID information, and the first authentication frame carries the target AGID information, which is determined from the AGID information of the first AP and / or the AGID information of the second AP.

[0100] In some embodiments, the AGID information of the first AP or the second AP may include only one or a group of AGID information, or it may include multiple or more groups of AGID information; for example, it may be a list of AGID information. If multiple or more groups of AGID information exist, the first AP can negotiate with the second AP through a common action frame to determine the target AGID information to be selected, and then mutually authenticate each other based on the key information corresponding to the AGID information. The target AGID information may also be a list of target AGID information.

[0101] In some embodiments, the AGID information includes one of the following: AGID, vendor identifier, multi-access point collaboration identifier (MAPC ID), or the AGID information is wildcard type AGID information, wherein the wildcard type AGID information is used to indicate that the first AP and the second AP use open mode for mutual authentication, that is, any two APs can authenticate based on the wildcard type AGID information.

[0102] In some embodiments, the first public action frame or the second public action frame includes:

[0103] The type field indicates the purpose of the frame;

[0104] Public action frame field;

[0105] The AGID element field is used to carry at least one AGID information.

[0106] The Robust Security Network Element (RSNE) field indicates the key suite and capability set of a robust security network; and

[0107] The Robust Security Network Extension Element (RSNXE) field is used to indicate additional key sets and capability sets for a Robust Security Network (RSN).

[0108] In some embodiments, the method further includes: when the first public action frame satisfies a preset first condition, the second AP determines that the first AP and the second AP can authenticate each other, wherein the preset first condition includes one of the following:

[0109] 1) The AGID information of the first AP carried in the first public action frame includes wildcard AGID information;

[0110] 2) The AGID information of the first AP carried in the first public action frame is partially or entirely the same as the AGID information of the second AP;

[0111] 3) The AGID information of the first AP carried in the first public action frame contains at least a specific AGID information from the AGID information of the second AP;

[0112] 4) The key suite capability set information carried by the first public action frame is partially or entirely the same as the key suite capability set information of the second AP, wherein the key suite capability set information includes RSNE information and RSNXE information.

[0113] In this embodiment, the first AP and the second AP can not only confirm whether they can authenticate each other by matching AGID information, but also confirm whether they can authenticate each other based on the key suite capability set information supported by the first AP and the second AP, making the method of determining authentication information more flexible.

[0114] In some embodiments, step S402 can be divided into the following two types:

[0115] Step S402A: The second AP sends a second common action frame to the first AP.

[0116] In step S402B, the second AP sends the first authentication frame to the first AP.

[0117] In some embodiments, for step S402A, the method further includes the following steps:

[0118] Step S403A: In response to the fact that the second common action frame was sent to the first AP, the first authentication frame is received from the first AP;

[0119] Step S404A: Send a second authentication frame to the first AP;

[0120] Step S405A: Receive a third authentication frame from the first AP.

[0121] In some embodiments, for step S402B, the method further includes the following steps:

[0122] Step S403B: In response to the fact that the first authentication frame was sent to the first AP, a second authentication frame is received from the first AP;

[0123] Step S404B: Send a third authentication frame to the second AP.

[0124] In this embodiment, after receiving the first common action frame, the second AP can initiate an authentication process with the first AP after confirming that the two can authenticate each other. Alternatively, the second AP can simply send the second common action frame back to the first AP, and then the first AP can initiate an authentication process with the second AP.

[0125] In some embodiments, the first authentication frame is an authentication request frame, the second authentication frame is an authentication response frame, and the third authentication frame is an authentication confirmation frame.

[0126] In one exemplary embodiment, the formats of the first authentication frame, the second authentication frame, and the third authentication frame can be implemented based on the three PASN authentication frame extensions in the Pre-Association Security Negotiation (PASN) protocol defined in IEEE 802.11az. PASN authentication frames perform authentication between the AP and the STA, while the authentication frames in this application perform authentication between two APs.

[0127] In some embodiments, the first authentication frame and the second authentication frame include an AGID element field, an RSNE field, and / or an RSNXE field. The second authentication frame also includes a status code field, wherein the AGID element field of the first authentication frame and the AGID element field of the second authentication frame carry the same or different AGID information; and / or, the status code field of the second authentication frame carries a status code to indicate at least one of the following: AGID information mismatch, Authentication Key Management (AKM) information mismatch, unicast key suite information mismatch, or success. A success status code means that the AGID information, AKM information, and / or unicast key suite information match successfully.

[0128] In some embodiments, both the first authentication frame and the second authentication frame carry the target AGID information. The method further includes: the first AP obtaining or generating key information based on the target AGID information, and completing mutual authentication with the second AP based on the key information, wherein the first AP and the second AP obtain or generate the same key information based on the target AGID information.

[0129] In this embodiment, the first AP and the second AP can not only confirm that they can authenticate each other, but also, when the first AP or the second AP supports multiple sets of AGID information, the first AP and the second AP can determine which set of AGID information to use for authentication based on the target AGID information, which can improve authentication efficiency.

[0130] In some embodiments, the second authentication frame and / or the third authentication frame also carry a Message Integrity Code (MIC), and AGID information can be used as an input parameter in the process of generating the MIC value in the second authentication frame and / or the third authentication frame.

[0131] In some embodiments, the first public action frame, the second public action frame, the first authentication frame, and the second authentication frame also carry a BSSID. The BSSID includes one of the following: the MAC address of the first AP, the MAC address of the second AP, and a wildcard MAC address.

[0132] In some embodiments, the first authentication frame, the second authentication frame, and the third authentication frame further carry an authentication algorithm number field and / or an AKM field, wherein the authentication algorithm number field and / or the authentication key management AKM field are used to indicate mutual authentication between the first AP and the second AP.

[0133] In some embodiments, the first AP and the second AP are single-link access points, multi-link access points (APMLD), non-collocated multi-link access points (non-collocated AP MLD), or seamless mobility domain (SMD) access points.

[0134] Through the embodiments described above in this application, the first AP can interact with the second AP to exchange AGID information, negotiate and confirm the authentication information to be used, and complete the authentication process, thus achieving efficient and secure mutual authentication between multiple access points. This method not only reduces latency in the authentication process but also enhances network security, especially in multi-link and seamless mobile domain environments, significantly improving user experience and ensuring the continuity and reliability of data transmission. Furthermore, by using wildcard AGID information, this method also supports authentication in open mode, enhancing interoperability and flexibility between access points.

[0135] The following section will provide a detailed explanation of the AGID information exchange and MAP authentication process between the first AP (denoted as AP1) and the second AP (denoted as AP2), taking into account the specific types of public action frames and authentication frames.

[0136] Figure 5 This is a schematic diagram of an authentication process based on AGID information in one embodiment of this application, as shown below. Figure 5 As shown, the process includes the following steps:

[0137] Step S501, AP1 sends a common action frame to AP2, which is of type discovery request and contains AGID information;

[0138] In step S502, AP2 sends a common action frame to AP1, which is of type discovery response and contains the same AGID information;

[0139] Step S503: AP1 sends an authentication request frame to AP2, which includes AGID information;

[0140] Step S504, AP2 sends an authentication response frame to AP1, containing the same AGID information;

[0141] Note: Based on the same AGID information, AP1 and AP2 retrieved the same password information password1, and completed mutual authentication based on password1 and the SAE method.

[0142] In step S505, AP1 sends an authentication confirmation frame to AP2.

[0143] In this embodiment, the discovery request frame may carry only the AGID information of one authentication group, and AP2 informs AP1 that it also supports the AGID information through the discovery response frame. After confirming that both support the same AGID information, AP1 can actively initiate the subsequent authentication process based on the AGID information.

[0144] Figure 6 This is a schematic diagram of an authentication process based on an AGID in the AGID list in one embodiment of this application, as shown below. Figure 6As shown, the process includes the following steps:

[0145] In step S601, AP1 sends a common action frame to AP2. The frame is of type discovery and contains AGID list information.

[0146] In step S602, AP2 sends an authentication request frame to AP1, which includes the AGID information it has selected.

[0147] In step S603, AP1 sends an authentication response frame to AP2, which contains the same AGID information as the authentication request frame.

[0148] Note: Based on the same AGID information, AP1 and AP2 retrieve the same password information and complete mutual authentication based on the password and the SAE method.

[0149] In step S604, AP1 sends an authentication confirmation frame to AP2.

[0150] In this embodiment, the request frame is found to carry an AGID list. AP2 selects an AGID from the list and initiates an authentication process based on the selected AGID.

[0151] Figure 7 This is a schematic diagram of the overall process of MAP authentication based on AGID information in one embodiment of this application, as shown below. Figure 7 As shown, the process includes the following steps:

[0152] Step S1, AP1 sends a first public action frame containing at least one Authentication Group Identifier (AGID) information.

[0153] In step S2, AP2 receives the first common action frame and takes one of the following actions: (a) does not respond to the first common action frame; (b) responds to the first common action frame and sends the second common action frame; (c) sends the first authentication frame.

[0154] Step S3: After receiving the second common action frame, AP1 sends the first authentication frame as a response (optional step).

[0155] In step S4, after AP1 or AP2 receives the first authentication frame, it sends a second authentication frame as a response.

[0156] In step S5, after AP2 or AP1 receives the second authentication frame, it sends a third authentication frame as a response.

[0157] In this embodiment, if AP2 sends a second common action frame in step S2, then step S3 (AP1 sends a first authentication frame) needs to be executed, and AP2 sends a second authentication frame while AP1 sends a third authentication frame. If AP2 sends a first authentication frame in step S2, then step S3 is skipped, and AP1 sends a second authentication frame while AP2 sends a third authentication frame.

[0158] In some embodiments, the first common action frame includes a first information field (e.g., an action field) indicating that the frame is intended for discovery or probe. For example, if the frame is intended for probe, the first common action frame could be a probe request, and the second common action frame could be a probe response. Similarly, if the frame is intended for discovery, the first common action frame could be a discovery request, and the second common action frame could be a discovery response.

[0159] In some embodiments, AGID information may include at least one of the following:

[0160] Authentication Frame Identifier (AGID): The identifier of the authentication group that enables each AP within the group to complete mutual authentication;

[0161] Vendor ID, vendor information;

[0162] Multi-Access Point Collaboration Identifier (MAPC ID) is an identifier that enables multi-AP collaboration.

[0163] An empty field is one that does not contain any of the three types of information mentioned above. When the AGID element field of the first authentication frame is an empty field (or wildcard AGID information) or the first authentication frame does not contain an AGID information field, the APs use open mode to complete authentication and generate key information.

[0164] In some embodiments, when the first public action frame contains wildcard AGID information, any AP that receives the first public action frame can reply with a second public action frame or a first authentication frame.

[0165] In some embodiments, the first or second public action frame may also include RSNE, RSNXE, and (PASN)AKMP in the RSNE field, which are used to indicate their key suite capability set information.

[0166] In some embodiments, the reasons why AP2 receives but does not respond to the first common action frame in step S2 (operation c) above include one of the following: 1) the AGID contained in the first common action frame is inconsistent with the AGID information of AP2; 2) the AGID list contains multiple AGID information, but at least one specific AGID information is inconsistent; 3) the RSNE and RSNXE capability set information contained in the first common action frame is inconsistent with the RSNE and RSNXE capability set information of AP2; 4) the MAPCID contained in the first common action frame is inconsistent with the MAPC ID information of AP2.

[0167] In some embodiments, the second common action frame that AP2 responds to and sends in step S2 (operation b) above contains one of the following information: 1) the same AGID information as the first common action frame; 2) the Receiver Address (RA) of the first common action frame is the MAC address of AP2; 3) the same or partially the same RSNE and RSNXE capability set information as the first common action frame.

[0168] In some embodiments, the first public action frame and the second public action frame contain an AGID list information, the list of which contains at least one AGID information.

[0169] In some embodiments, the first authentication frame contains an AGID list, which contains at least one AGID, or the first authentication frame contains one AGID.

[0170] In some embodiments, based on the AGID, RSNE, and other information contained in the first authentication frame, the second authentication frame may contain one of the following information (or any combination thereof): containing the same AGID information; not containing the same AGID information; a status code indicating an AGID information mismatch; a status code indicating an AKM information mismatch; a status code indicating a pairwise cipher suite information mismatch; or a status code indicating a successful (information match). Furthermore, when the receiver receives a status code in the second authentication frame indicating a failure (such as a mismatch of certain information types), it terminates the PASN process or attempts to redo the process (starting from sending the first authentication frame).

[0171] In some embodiments, AP1 and AP2 can be one of a single-link access point, a multi-link access point (AP MLD), a non-collocated multi-link access point (non-collocated AP MLD), or a seamless mobility domain (SMD) access point.

[0172] In some embodiments, the BSSID address information field in the management frames (including but not limited to the first common action frame, the second common action frame, the first authentication frame, and the second authentication frame) exchanged between AP1 and AP2 can be set to one of the following: the MAC address information of the sending end (i.e., AP1); the MAC address information of the receiving end (i.e., AP2); or the wildcard type MAC address (wildcard BSSID) information.

[0173] In some embodiments, the Authentication Algorithm Number field of the authentication frame indicates mutual authentication between APs.

[0174] In some embodiments, the Authentication Key Management (AKM) field of the authentication frame indicates mutual authentication between APs.

[0175] In some embodiments, AGID is used as an input parameter in the key (e.g., PTK, PMK, key seed pwd-seed) generation process, for example: pwd-seed = HKDF-Extract(AGID, password[||identifier]); where password is the password information, HKDF-Extract is a HASH function based on prime number length; and identifier is the key identification information (or AGID information).

[0176] In some embodiments, AGID is used as an input parameter in the generation process of the MIC value in the second authentication frame and / or the third authentication frame. Specifically, the generation process of MIC1 or MIC2 includes at least one of the following parameters:

[0177] AP1 MAC address, AP1 BSSID information, first action frame RSNE information, first action frame RSNXE information, first action frame AGID information, RSNE information in AP1 beacon frame, RSNXE information in AP1 beacon frame, second authentication frame body, first authentication frame RSNE information, first authentication frame RSNXE information;

[0178] AP2 MAC address, AP2 BSSID information, second action frame RSNE information, second action frame RSNXE information, second action frame AGID information, RSNE information in AP2 beacon frame, RSNXE information in AP2 beacon frame, and third authentication frame body;

[0179] Second authentication frame RSNE information, second authentication frame RSNXE information.

[0180] In an exemplary embodiment, MIC1 = HMAC-HASH(KCK, AP1 MAC|| AP2 MAC|| First Action Frame RSNE|| First Action Frame RSNXE|| First Action Frame AGID|| Second Authentication Frame Body).

[0181] In an exemplary embodiment, MIC2 = HMAC-HASH(KCK, AP1 MAC || AP2 MAC || Second Authentication Frame Body || Third Authentication Frame Body); or, MIC2 = HMAC-HASH(KCK, AP1 MAC || AP2 MAC || Second Action Frame RSNE || Second Action Frame RSNXE || Second Action Frame AGID || Second Authentication Frame Body || Third Authentication Frame Body).

[0182] Figure 8 This is a schematic diagram of the format of the AGID element field in one embodiment of this application, as shown below. Figure 8 As shown, the AGID element field contains the following three fields:

[0183] The Element ID field is used to uniquely identify this field;

[0184] The Length field indicates the length of the AGID. When the Length field is 0, it indicates a wildcard type AGID.

[0185] The AGID field contains the specific AGID value.

[0186] Figure 9 This is a schematic diagram of the format of an action frame in one embodiment of this application, such as... Figure 9 As shown, the action frame contains the following fields:

[0187] The Category field identifies the type information of the action frame;

[0188] The Public Action field indicates whether the frame type is a public action frame or a protected dual-of-public action frame. For example, setting it to discovery indicates that the public action frame is of the discovery type;

[0189] The AGID element field indicates authentication group information;

[0190] The RSNE field indicates the key suite included in the RSN and elements related to RSN capabilities;

[0191] The RSNXE field indicates additional key suites and RSN capability set information for the RSN.

[0192] In this application embodiment, a MAP discovery and authentication method based on AGIDs contained in a common action frame is proposed to solve the problem of key information used for determining whether MAPs can authenticate each other and for authentication between APs. The method mainly includes the following improvements: (1) the discovery information frame contains an AGID or a list of AGIDs; (2) the authentication request and response frames contain the selected AGID; (3) a discovery and authentication method based on wildcard AGIDs; (4) the same key information is obtained based on the same AGID information to further complete mutual authentication; (5) the AKMP information contained in the authentication frame indicates mutual authentication between APs; (6) the authentication algorithm number field in the authentication frame indicates mutual authentication between APs.

[0193] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0194] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps in any of the above method embodiments.

[0195] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0196] Embodiments of this application also provide an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0197] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0198] Embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0199] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0200] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0201] The above description is merely an exemplary embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A multi-access point (MAP) authentication method, characterized in that, Applied to the first access point (AP), including: Send a first public action frame carrying the authentication group identifier (AGID) information of the first AP to the second AP.

2. The method according to claim 1, characterized in that, The method also includes one of the following: The second AP receives a second common action frame or a first authentication frame in response to the second AP determining, based on the AGID information of the first AP, that it has the capability to perform mutual authentication with the first AP; Receive the second common action frame or the first authentication frame from the second AP in response to the second AP determining that the AGID information of the first AP is wildcard type AGID information; Receive the second public action frame or the first authentication frame from the second AP in response to the second AP determining that the receiving address of the first public action frame is the media access control MAC address of the second AP; The second AP did not receive the second common action frame or the first authentication frame in response to the second AP determining, based on the AGID information of the first AP, that it does not have the ability to perform mutual authentication with the first AP.

3. The method according to claim 1, characterized in that, The method further includes: The second AP receives a second common action frame or a first authentication frame, wherein the second common action frame carries the AGID information of the second AP or the target AGID information, and the first authentication frame carries the target AGID information, which is determined from the AGID information of the first AP and / or the AGID information of the second AP.

4. The method according to claim 2 or 3, characterized in that, The first common action frame or the second common action frame includes: The type field indicates the purpose of the frame; Public action frame field; The AGID element field is used to carry at least one AGID information. The RSNE field of the Robust Security Network element indicates the key suite and capability set of the robust security network; and Extend the RSNXE field of the robust security network element to indicate additional key suites and capability sets for the robust security network.

5. The method according to claim 1, characterized in that, When the first public action frame meets a preset first condition, the first AP and the second AP can authenticate each other, wherein the preset first condition includes one of the following: The AGID information of the first AP carried in the first public action frame includes wildcard AGID information; The AGID information of the first AP carried in the first public action frame is partially or entirely the same as the AGID information of the second AP; The AGID information of the first AP carried in the first public action frame includes at least a specific AGID information from the AGID information of the second AP; The key suite capability set information carried in the first public action frame is partially or entirely the same as the key suite capability set information of the second AP, wherein the key suite capability set information includes RSNE information and / or RSNXE information.

6. The method according to claim 2 or 3, characterized in that, The AGID information or target AGID information of the second AP carried in the second public action frame or the first authentication frame is partially or entirely the same as the AGID information of the first AP carried in the first public action frame; and / or, In response to receiving a second common action frame from the second AP, the key suite capability set information carried by the second common action frame is partially or entirely the same as the key suite capability set information carried by the first common action frame, wherein the key suite capability set information includes RSNE information and / or RSNXE information.

7. The method according to claim 1, characterized in that, The method further includes: In response to receiving the second common action frame sent by the second AP, a first authentication frame is sent to the second AP; Receive the second authentication frame from the second AP; Send a third authentication frame to the second AP.

8. The method according to claim 1, characterized in that, The method further includes: In response to receiving the first authentication frame sent by the second AP, a second authentication frame is sent to the second AP; Receive the third authentication frame from the second AP.

9. The method according to claim 7 or 8, characterized in that, The first authentication frame is an authentication request frame, the second authentication frame is an authentication response frame, and the third authentication frame is an authentication confirmation frame.

10. The method according to claim 7 or 8, characterized in that, The first authentication frame and the second authentication frame include an AGID element field, an RSNE field, and / or an RSNXE field. The second authentication frame also includes a status code field. The AGID element field of the first authentication frame and the AGID element field of the second authentication frame carry the same or different AGID information; and / or, The status code carried in the status code field of the second authentication frame is used to indicate at least one of the following: AGID information mismatch, authentication key management AKM information mismatch, unicast key suite information mismatch, or success.

11. The method according to claim 7 or 8, characterized in that, Both the first authentication frame and the second authentication frame carry target AGID information, wherein the method further includes: The first AP obtains or generates key information based on the target AGID information, and completes mutual authentication with the second AP based on the key information, wherein the first AP and the second AP obtain or generate the same key information based on the target AGID information.

12. The method according to claim 7 or 8, characterized in that, The first public action frame, the second public action frame, the first authentication frame, and the second authentication frame also carry a Basic Service Set Identifier (BSSID), wherein the BSSID includes one of the following: the MAC address of the first AP, the MAC address of the second AP, or a wildcard MAC address.

13. The method according to claim 7 or 8, characterized in that, The first authentication frame, the second authentication frame, and the third authentication frame also carry an authentication algorithm number field and / or an authentication key management (AKM) field, wherein the authentication algorithm number field and / or the authentication key management (AKM) field are used to indicate mutual authentication between the first AP and the second AP.

14. The method according to claim 1, characterized in that, The first AP and the second AP are single-link access points, multi-link access points, non-co-located multi-link access points, or seamless mobile domain access points.

15. The method according to claim 1, characterized in that, The AGID information includes one of the following: AGID, vendor identifier, multi-access point collaboration identifier (MAPC ID), or the AGID information is a wildcard type AGID information, wherein the wildcard type AGID information is used to indicate that the first AP and the second AP use open mode for mutual authentication.

16. A multi-access point (MAP) authentication method, characterized in that, Applied to second access point (AP), including: Receive the first public action frame carrying the authentication group identifier (AGID) information of the first AP from the first AP.

17. The method according to claim 16, characterized in that, The method also includes one of the following: In response to determining, based on the AGID information of the first AP, that it has the capability to perform mutual authentication with the first AP, a second common action frame or a first authentication frame is sent to the first AP. In response to determining that the AGID information of the first AP is wildcard type AGID information, the second common action frame or the first authentication frame is sent to the first AP; In response to determining that the receiving address of the first public action frame is the media access control MAC address of the second AP, the second public action frame or the first authentication frame is sent to the first AP; In response to determining, based on the AGID information of the first AP, that it does not have the ability to perform mutual authentication with the first AP, the second common action frame or the first authentication frame is not sent to the first AP.

18. The method according to claim 16, characterized in that, The method further includes: Send a second common action frame or a first authentication frame to the first AP, wherein the second common action frame carries the AGID information of the second AP or the target AGID information, and the first authentication frame carries the target AGID information, which is determined from the AGID information of the first AP and / or the AGID information of the second AP.

19. The method according to claim 17 or 18, characterized in that, The method further includes: In response to the second common action frame being sent to the first AP, a first authentication frame is received from the first AP; Send a second authentication frame to the first AP; Receive the third authentication frame from the first AP.

20. The method according to claim 17 or 18, characterized in that, The method further includes: In response to the first authentication frame being sent to the first AP, a second authentication frame is received from the first AP; Send a third authentication frame to the second AP.

21. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method described in any one of claims 1 to 20.

22. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 20.

23. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 20.

Images